Version 2026-11-03. How long Zoi ID keeps each kind of data, and why. Deletion runs automatically every day. "Decision" means the final outcome of a verification (approved, not approved, expired or cancelled).
| Data | Kept until | Why |
|---|---|---|
| Verification never submitted | 7 days after it started | the user may come back to finish |
| Verification submitted but never decided | 60 days, then it expires | reviews must not stay open forever |
| Document photos, document capture videos, chip files, face video and frames, proof of address and source of funds documents and images of their pages | 90 days after the decision | handling questions and appeals, catching fraud |
| The same, for a person under the minimum age | 24 hours | we must not keep minors' data |
| The same, after withdrawal of consent or account deletion | at once (within 24 hours) | the user's choice |
| Face templates | never stored (seconds, in memory) | not needed after the comparison |
| What was read from a proof of address document, its signature and file checks, an official code printed on it, the address the user confirmed, and the device time zone and language | 90 days after the decision; at once on withdrawal of consent, account deletion or cancellation | handling questions and appeals, catching fraud |
| Source of funds and source of wealth on the verification: the user's answers, what was read from the documents (type, date, issuer, name, employer, main amount and currency), their signature and file checks, and the reviewer's verdict on each document | 90 days after the decision; at once on withdrawal of consent, account deletion or cancellation | handling questions and appeals, catching fraud |
| Identity data (name, date of birth, nationality, document number and expiry, address and how it was proven: method, document type and date) | while the user's account with the app exists, at most 5 years after the last verification | proving the verification and keeping one account per person |
| Source of funds summary kept with the identity (the answers, the type, date, issuer, main amount and currency of each accepted document, and the evidence level) | like identity data: while the user's account with the app exists, at most 5 years after the last verification; at once on withdrawal of consent or account deletion | giving the app's compliance team the result of its checks, and showing the user their earlier answers when the same app asks again |
| Keyed fingerprints of document and identity, and of proof of address and source of funds files and their signatures (HMAC; cannot be reversed) | 5 years after the last verification | preventing duplicate and fraudulent accounts |
| Decisions and check results (without names or images) | 5 years after the last verification | proving what was decided and why |
| Fraud labels after a decision (status such as reported, suspected or confirmed fraud, or checked and fine; category; who gave it) and second-review results, without names or images | 5 years after the last verification; free-text notes are deleted with the photos (90 days after the decision, at once on withdrawal or account deletion) | measuring how often checks let fraud through, and improving them |
| Sanctions and politically exposed person screening records | 10 years | United States sanctions recordkeeping (31 CFR 501.601) |
| Keyed fingerprints of the IP address and of the device identifier (HMAC; cannot be reversed) and the network type (data centre, VPN, Tor) | 90 days after the step | fraud prevention (many attempts from one device or network) |
| Fingerprints (SHA-256) of uploaded photos and videos | 90 days after the upload; at once on withdrawal or account deletion | catching the same file sent again in another verification |
| Parts of a photo or video that is still being uploaded (encrypted; kept only so that a dropped connection can continue where it stopped) | until the verification uses the file, the upload is cancelled, or the verification is sent, ends or is deleted; at most 2 hours after the upload started | finishing uploads on slow or unstable mobile networks |
| The public part of the security key the app makes for the device check, and its check result | Android: 6 hours; iPhone: until unused for 400 days (not linked to a person) | proving the photos and videos come from the genuine app |
| Reviewer access log (who opened what and when) | 10 years | security and accountability |
| Consent records (time, version, language, choices) | as long as the related data, at least 5 years | proving consent |
| Encrypted backups | 30 days, then overwritten | recovery from failures |
| Test mode (sandbox) sessions and everything linked to them | 7 days after they were created; photos and videos are never kept | partners testing their integration |
| Partner dashboard accounts (email, name, role, passkeys, authenticator secret) | until the account is deleted | running the account |
| Dashboard sign-in links, passkey challenges and sessions | 1 day after they expire or are used | security |
| Dashboard audit log (who changed keys, settings, members and contracts, and who opened a source of funds document) | 10 years | security and accountability |
Legal hold. A court order, an authority's request or an active legal claim can pause deletion only for the data it covers, only while it lasts.
Restores. If we ever restore a backup, every deletion done since that backup is applied again before the service restarts.
Proof of address. The app that asked for proof of address gets the result, not the document. It keeps its own records for the period its law sets (often 5 years after the end of the customer relationship). We keep the document only for the period above.
Source of funds and source of wealth. The app that asked gets the result, not the documents. Only its compliance staff can view images of the pages in our partner dashboard, while we still keep them, and each view is logged. The app keeps its own anti-money-laundering records for the period its law sets (often 5 years after the end of the customer relationship); that is its own duty. We keep the documents only for the period above.
Regulated activity. If an app we verify for becomes a regulated financial service, the law may require longer retention for its customers (for example 5 years after the end of the relationship for identity records). We will update this schedule before that applies and tell users.