Trust Center - Security, Privacy & Compliance

POY Verify is built on zero-data architecture. Your biometrics never leave your device. We cannot see, store, or sell what we never collect.

Zero Data Stored On-Device Processing GDPR Compliant BIPA Compliant

Zero-Data Architecture

POY Verify processes all biometric analysis on-device using the hardware Secure Enclave built into modern smartphones and computers. Personal data never touches our servers - not during verification, not after, not ever.

🔒 What IS Stored on Our Servers

  • + Public keys (ECDSA P-256) - cannot identify a person
  • + SHA-256 hashes of verification results
  • + Device class (e.g. "iPhone" or "Android") - no serial numbers
  • + Timestamp of verification event
  • + Trust score (numerical confidence rating)
  • + Platform-specific derived public key

🛡 What is NEVER Stored or Transmitted

  • Names, emails, or phone numbers
  • Facial images, scans, or templates
  • Fingerprints, iris scans, or voice prints
  • IP addresses or GPS coordinates
  • Device serial numbers or IMEI
  • Browsing history or behavioral profiles

Compliance & Certifications

POY Verify achieves compliance through architecture, not through policy workarounds. When you never collect the data, most regulations are satisfied by default.

Compliant

GDPR - EU General Data Protection Regulation

No biometric data on servers means no personal data to protect, export, or delete. Data minimization is not a policy - it is the architecture itself.

Compliant

BIPA - Illinois Biometric Information Privacy Act

BIPA requires consent before collecting biometric identifiers. POY never collects biometric data at all - processing happens entirely on-device in the Secure Enclave.

Compliant

CCPA / CPRA - California Consumer Privacy Act

Minimal data processing with no personal information collected. There is nothing to sell, share, or disclose because we never have it.

Aligned

HIPAA - Healthcare Use Cases

POY's zero-data model aligns with HIPAA requirements for healthcare identity verification. No Protected Health Information (PHI) is ever processed or stored by POY servers.

Aligned

NIST SP 800-63 - Digital Identity Guidelines

POY's cryptographic verification aligns with NIST Identity Assurance Level 2 (IAL2) requirements using hardware-bound credentials and liveness detection.

Aligned

EU AI Act - Content Authentication

POY's content stamping capabilities support EU AI Act requirements for marking AI-generated content and proving human-created content authenticity.

On Roadmap

SOC 2 Type II

SOC 2 Type II certification is on our roadmap. While our zero-data architecture inherently satisfies many SOC 2 controls, we are pursuing formal certification for enterprise customers.

Security Architecture

Every layer of POY Verify is designed with security as a constraint, not a feature. From cryptographic primitives to hardware isolation, the system is built to be trustworthy even if you trust no one.

Elliptic Curve Cryptography

ECDSA P-256 / secp256r1

All verification signatures use ECDSA on the NIST P-256 curve - the same standard used by Apple, Google, and government systems. Keys are generated and stored in hardware.

Content Hashing

SHA-256 (256-bit)

Verification results and content stamps are hashed using SHA-256. Hashes are one-way - they confirm authenticity without revealing the original input data.

Hardware Secure Enclave

Apple SE / Google Titan M2 / Samsung Knox

Biometric processing happens inside the device's hardware security module. Keys never leave the enclave. Even if the OS is compromised, the enclave remains isolated.

HD Key Derivation

BIP-32 Hierarchical Deterministic

A unique key pair is derived for each platform using HD key derivation. Your identity on Platform A cannot be linked to Platform B - not even by POY.

Passkey Support

WebAuthn / FIDO2

POY supports WebAuthn and FIDO2 passkeys for passwordless authentication. Hardware-bound credentials eliminate phishing and credential stuffing attacks.

API Performance

<50ms response time

Verification API responses complete in under 50 milliseconds. Low latency means real-time verification without degrading user experience in production applications.

Data Handling - POY vs. Competitors

Most identity verification platforms collect and store sensitive personal data on their servers. POY Verify takes a fundamentally different approach.

Data Type Traditional KYC Biometric Platforms POY Verify
Full Name Collected & stored Often collected Never collected
Email / Phone Required Required Never collected
Facial Images Stored on servers Stored on servers On-device only
Biometric Templates Server-side storage Server-side storage Never leaves device
Government ID Scanned & stored Sometimes required Never required
IP Address Logged Logged Not logged
Location / GPS Tracked Often tracked Never tracked
Device Fingerprint Full fingerprint Full fingerprint Device class only
Cross-Platform Linking Linked by PII Linked by biometrics Unlinkable (HD keys)
Breach Exposure Risk High - PII + documents High - biometric data Minimal - hashes only

Third-Party Testing & Review

Transparency is not optional. We are committed to independent verification of our security claims.

Independent Security Review

POY Verify is actively engaging independent security firms to conduct penetration testing, architecture review, and cryptographic audit of our verification system. Results will be published here upon completion.

Our zero-data architecture significantly reduces the attack surface compared to traditional identity platforms. Even so, we believe trust must be verified - not assumed.

STATUS: INDEPENDENT REVIEW IN PROGRESS

Responsible Disclosure

We take security vulnerabilities seriously and appreciate the work of researchers who help us keep POY Verify secure.

Report a Vulnerability

If you have discovered a security vulnerability in POY Verify, please report it responsibly. We ask that you give us reasonable time to investigate and patch before public disclosure.

Please include a detailed description of the vulnerability, steps to reproduce, and any proof-of-concept code. We will acknowledge receipt within 48 hours and provide an initial assessment within 5 business days.

Security & Privacy FAQ

Common questions about how POY Verify handles security, privacy, and compliance.

Does POY Verify store my biometric data?
No. POY Verify processes all biometric analysis on your device using the hardware Secure Enclave. Only a cryptographic hash (SHA-256) of the verification result is stored - never the biometric data itself. Your face, fingerprint, and voice never leave your device.
How does POY Verify comply with GDPR if it operates in Europe?
POY Verify is compliant with GDPR by architecture, not just by policy. Since no personal data is collected or transmitted to our servers, there is no personal data to protect, delete, or export. The system stores only public keys and cryptographic hashes that cannot be reversed to identify a person.
What happens if POY Verify servers are breached?
If our servers were breached, attackers would find only public keys, SHA-256 hashes, device class labels, timestamps, and trust scores. None of this data can be used to identify, track, or impersonate any user. There are no names, emails, phone numbers, photos, or biometric templates to steal.
Can POY Verify track me across different platforms?
No. POY uses HD (Hierarchical Deterministic) key derivation to generate a unique, unlinkable key pair for each platform you verify on. Your identity on Platform A cannot be correlated with your identity on Platform B - not even by POY itself.
Is POY Verify open to independent security audits?
Yes. We are committed to transparency and are actively engaging independent security firms for third-party penetration testing and architecture review. We also maintain a responsible disclosure program and welcome reports from security researchers at security@proofofyou.com.

Built for trust. Verified by design.

Questions about our security architecture? Want to discuss enterprise compliance requirements?

Join the Waitlist Contact Us