What the GDPR says
The GDPR, the European data protection regulation, requires you to collect only the data you need. This is the data minimisation principle. It also requires you to protect that data.
Identity verification involves sensitive data: an ID document, a face, sometimes biometric data. The more you store, the more serious a leak would be for your creators and for your business.
What your PSP really needs
Your PSP does not ask you to send it passports. It wants to know that every person has been verified, is an adult, and that you can prove it. Reliable proof of the verification is enough, as long as you can present it.
Zero-knowledge proof
A zero-knowledge proof (ZKP) lets you prove a fact without revealing the data behind it. For example: "this person is over 18 and their identity has been verified", without passing on their date of birth or their ID document.
How Pleenk Approve helps
Pleenk has each identity verified by a certified verification partner, with a liveness check. The identity is encrypted by Pleenk and stored in a single wallet. The platform receives proof, never the ID document.
So you do not store ID documents on your servers. Yet you keep consistent end-to-end evidence for your PSP, your bank or a regulator.
Frequently asked questions
Can I still answer a request from my PSP?
Yes. You present the proof of verification and the report generated from Pleenk.
Where are the ID documents stored?
They are not stored by your platform. The identity is encrypted by Pleenk.
Is zero-knowledge proof recognised?
European regulators encourage privacy-preserving methods. In France, for example, the technical standard of the regulator Arcom includes a "double anonymity" option. Check the requirements of each country where you operate.