Trust Center
Identity data is the most sensitive data your users share. Zoi ID protects it at every step, and gives your security and compliance teams what they need to sign off with confidence.
Security in every layer
Protection is designed into how Zoi ID is built and run, from the first line of code to the last day of retention.
Encrypted everywhere
In transit and at rest, with a separate key for every file and every identity record.
Data stays in the EU
Identity data is stored in Germany, on infrastructure dedicated to Zoi ID.
No face templates
Faces are compared in isolated services, in memory only. No biometric template is stored.
Least-privilege access
Named staff, permissions set by role and an append-only audit trail of every view and decision.
Four-eyes decisions
Possible sanctions and PEP matches need two independent reviewers. Appeals go to a different reviewer.
Tested and verified
Automated security testing on every change. Every release is signed and verified before it runs.
Data residency
Identity data is stored and processed in Germany (EU). Access from anywhere else is limited to named staff and always logged.
- Storage
- Dedicated infrastructure in Germany, separate from every other Zoi system.
- Backups
- Encrypted before they leave our infrastructure, and kept in the EU.
- Network edge
- A global edge network protects every connection. Applicant data is not stored there.
- Access from outside the EU
- Named, trained reviewers and administrators only. Every time they open personal data, it is written to the audit log.
- Company and role
- Zoi Labs LLC, a Wyoming company in the United States. Processor for the partner's end users. Controller for sanctions records, security logs and fraud fingerprints.
- Transfers
- The data processing agreement includes the EU Standard Contractual Clauses (Module Two).
Encryption and key management
Proven, standard encryption, with every record locked on its own.
Read the security page- Encrypted in transit with modern TLS.
- Encrypted at rest with AES-256, with a separate key for every file and every identity record.
- Each encrypted item is bound to its own record. Copied to another record, it will not open.
- Keys are managed under a written policy and kept apart from the data they protect.
- Backups are encrypted before they leave our infrastructure.
- No face templates are stored. Faces are compared in memory, for one request only.
Access and operations
Strict control over who can see what, and a record of everything they do.
- Least-privilege access: named accounts, permissions set by role, and access only where the job needs it.
- Every view of personal data, every decision and every admin action goes to an append-only audit log, kept for 10 years.
- Reviewers are trained on a written manual before they get access.
- Face, liveness and document analysis run in isolated services inside our own infrastructure. No identity data goes to a third-party AI service.
- Partner API keys are scoped and stored only as hashes. Every webhook is signed.
- The partner dashboard supports passkeys and authenticator apps, and logs every change to keys, settings and members.
- Every erasure is recorded and applied again after any restore from a backup.
- We build and test with synthetic data only.
Continuous security testing
Automated checks run on every change and on a regular schedule. High-severity findings stop a release.
- Static analysis of all our code
- Dependency scanning for known vulnerabilities, with prompt security updates
- Secret scanning on every commit and across the full history
- Infrastructure and configuration scanning
- Fuzz testing of the code that reads chips, documents and images
- Dynamic testing of the web app and the API
Incident response and continuity
A clear plan for when something goes wrong, and firm commitments to the partners who rely on us.
- Response plan
- A written incident response plan covers containment, assessment and notification, with deadlines for each market we serve.
- Partner notice
- We tell you without undue delay, and within 36 hours at most, about a personal data breach that affects your users.
- Authorities
- Where we are responsible, we notify authorities and affected people within the time the law sets, usually 72 hours.
- Continuity
- Encrypted backups in the EU and written, step-by-step recovery procedures.
Retention
Default periods. A legal hold can stop the clock.
| Data | Kept until |
|---|---|
| Session never submitted | 7 days after it was created. |
| Open session (processing or in review) | 60 days at most, then it expires. |
| Document images, chip data, video | 90 days after the final decision. 24 hours if the person is under the minimum age. At once on withdrawal or erasure. |
| Identity details (name, date of birth, document number, address) | While the user's account with the partner exists and the identity is not revoked. At most 5 years after the last verification. |
| Duplicate check keys, decisions and check results without personal data | 5 years after the last session, to prevent fraud. |
| Sanctions screening records | 10 years, as sanctions record rules require. |
| Audit log | 10 years. |
| Backups | 30 days. |
Every erasure is logged and applied again after any restore from a backup.
Subprocessors
Companies that process personal data for Zoi ID. Each is bound by a written data processing agreement.
| Company | What they do | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting. Holds everything Zoi ID stores, always encrypted at rest. | Germany (EU) |
| Cloudflare, Inc. | Network protection, TLS, DNS and storage of encrypted backups. | Global edge network. Backups in the EU. |
| Google LLC | Play Integrity: a yes or no answer about the app and device. No identity data. | United States |
| Apple Inc. | App Attest: proof that a request comes from the genuine iOS app. No identity data. | United States |
Partners get 30 days' notice before we add or replace a subprocessor, and can object.
Report a vulnerability
Found a security issue? Write to official@zoi.network. We welcome good-faith research and reply within 3 working days.
Open security.txt- Tell us what you found and how to repeat it.
- Use only your own test accounts and synthetic data. Do not open other people's data.
- No denial of service, no social engineering, and no tests against our subprocessors.
- Give us time to fix the problem before you publish it.
Public documents
Available under NDA
- Controls mapping to SOC 2 and ISO/IEC 27001:2022
- Completed CAIQ v4 and SIG Lite style questionnaires
- A short form with the security questions buyers ask most
- Our information security policies
- Security design documentation and our data protection impact assessment
- Contract terms for your own penetration test or an independent assessment
Put a real person behind every account
Zoi ID is launching soon. Early access partners get sandbox keys, a direct line to our team and a setup that fits their markets.
Or write to official@zoi.network