Security and privacy
Your users' data stays in Europe, with us.
Photos, data read and decisions stay on our servers, in the European Union. The analysis is done by our own engine: no third-party service sees your users.
Hosting and analysis
- Hosting in the European Union.
- Document reading, face comparison and liveness by our own engine, on our servers.
- No photo or data sent to a third-party analysis or artificial intelligence service.
Encryption
- Every photo is encrypted (XChaCha20-Poly1305) and bound to its verification.
- It is decrypted only in memory, for the time of an analysis or an authorised display.
- Data read from documents is encrypted in the database.
Access and traceability
- Each client sees only its own data.
- Document viewed, decision, API key, webhook, setting, erasure: every sensitive action goes into a chained audit log whose integrity can be verified.
- Two-factor authentication in the dashboards.
- Oversight: our team may look at your problematic verifications (to review, declined, retakes, failures) to improve the engine. Enabled by default, logged in your audit log, removed at your request.
Retention and erasure
- Retention period set for each client, from 30 days to 10 years (5 years by default, as anti-money laundering rules require).
- Erasure of a user on request, through the API or in the dashboard.
Integration
- API keys stored as a hash and shown only once.
- Signed and timestamped webhooks; internal addresses refused, redirects never followed.
- Time-limited verification links, bound to the browser that opens them.
- Capture pages without any third-party script or content, under a strict content security policy.
GDPR: who does what
- Your company is the controller; Sanno acts as a processor.
- Your user is informed before starting and consents to the biometric analysis.
- No automatic decline on a mediocre photo: your team decides the cases to review.
A security question, a questionnaire for us to fill in? Write to us
Let's talk about your verifications
Tell us what you need to verify and at what pace: we will come back to you with a proposal.
Contact us