Security and trust

Hold as little as possible. Protect what must be held.

VU is built to keep proofs rather than personal data, and to wall each customer's records off from every other. Here is what it does today, and where it stands on certification.

Proofs, not data

When you check a person yourself, VU receives only the result. It never sees the documents.
When VU checks a passport, it keeps no passport contents, and deletes face images once the check is decided.
Sanctions screening happens at the moment of each check. Nothing about the person is kept, except while a possible match is reviewed.

Your data stays yours

Each customer's data is walled off by the database itself, so a request can reach only its own customer's records.
API keys are stored only as one-way hashes, and shown once.
Sign-in is passwordless, with passkeys, and sensitive actions ask for the passkey again.
An audit log records account changes: who, when and from where.

Keys that never leave the vault

Credentials are signed inside Google Cloud's key-management service, and the private keys never leave it.
The public keys are published, so anyone can check a credential without asking VU.

Where data lives

The service and its database run on Google Cloud in the United States.
The live face check runs on Amazon Web Services in the United States, and its images are not kept.
Data is encrypted in transit and at rest.

Open standards, no lock-in

Credentials follow W3C Verifiable Credentials and the OpenID standards for issuing and showing them, with SD-JWT for sharing one fact at a time.
Any software that follows the standards can read them.

Who we work with

The services that process personal data for us, and how long we keep each kind of data, are listed in our Privacy Policy.

Certification

Not certified yet

VU's controls are being built to these standards now, and the records live with the code. External audits follow funding. Until a certificate is issued, we will not claim one.

Standard	Why	When
ISO/IEC 27001	Information security, for every customer	First
UK digital verification services trust framework	So UK-regulated customers can rely on the passport check	Next
ETSI TS 119 461	Identity proofing, for EU-regulated customers	When they ask
SOC 2 Type II	For customers in the United States	When they ask

Found a problem?

Tell us at support@vucredentials.com. We read every report.

Built to keep less

Talk to us about what your platform needs to hold, and what it doesn't.

Apply for access Check identity