Secure Portal
Authenticated, encrypted, role-bounded submission—not ordinary email, unclear links, or informal attachments.
Sensitive identity evidence governance
Identity Verification
Chain of Custody
◆
If a license or passport fails inspection: stop. No face scan.
Sensitive identity evidence demands a traceable purpose, secure handling, component-level status, and verified closure.
Adopt the Custody StandardDocument Receipt
Immediate receipt identifies the file type, time, requesting purpose, session, controller, and verification provider.
Decision Gate
Document status is resolved and displayed separately before any biometric collection may be authorized.
Vendor & Use Disclosure
Every collector, verifier, processor, reviewer, recipient, purpose, reuse, and derivative is named.
Retention & Deletion
Retention begins with a stated limit; deletion, redaction, restriction, or legal hold remains visible and provable.
Verified Closure
The subject receives an exportable custody report showing disposition of every document and biometric component.
The governing principle
Collection creates a duty to account.
A person should never be left unable to determine where a license, passport, selfie, face scan, or liveness record went.
Before collection, the system must identify the purpose, requesting organization, verification provider, data required, decision logic, comparison target, access boundaries, retention, deletion, and alternatives. After submission, it must issue a receipt and maintain a user-readable chain of custody through verified closure.
A failed component must never become an invisible gateway for collecting more sensitive data.
Sequential consent logic
Negative means stop.
Positive may proceed.
A negative document state cannot be transformed into a positive biometric permission. Each component keeps its own status, and only the valid positive path may advance.
License or passport result
PASSFAIL / UNREADABLE / MISMATCH / NON-QUALIFYINGPOSITIVE PATH
Consent checkpoint
Explain why the scan is necessary, what it will be compared against, who receives it, and how long it will be retained.
Face/liveness scan may proceedNEGATIVE PATH
STOP COLLECTION
Do not collect a face scan. Close or reset the attempt and explain receipt, retention, deletion, and appeal status.
No biometric escalationVerification decision matrix
Every combination has a defined outcome.
DocumentFace / livenessPermitted outcomeRequired treatment
PASSPASSVerified
Proceed only for the disclosed purpose. Issue session and report IDs, access history, retention terms, and closure details.
PASSFAILNot verified
Explain the biometric failure. Permit only a bounded retry with clear notice. Never label the identity verified.
FAILPASSNot verified
A positive face result cannot cure a failed document. Quarantine or delete the biometric record unless a new valid document and renewed consent are provided.
FAILFAILNot verified
Stop collection. Close or reset the attempt. Provide deletion or redaction status for both failed components.
PENDINGREQUESTED IN PARALLELNot determined
Allowed only when parallel collection was disclosed before capture. Show both components as pending—never falsely label one failed.
Identity Data Furnisher & Custody Report
As readable as a consumer credit-file disclosure.
The report must identify every entity and event—not merely state that verification “failed.” It must be exportable, account-specific, and understandable without reconstructing multiple support threads.
Session & report identity
A unique verification-session ID and custody-report ID for every attempt.
Component-level status
License front, license back, passport, selfie, face scan, and liveness status shown separately.
Every data furnisher
Requesting platform, verification vendor, subprocessors, cloud storage, human reviewers, and recipients.
What was created
Original files, extracted text and fields, document images, templates, embeddings, biometric derivatives, and risk signals.
Every access and disclosure
Who viewed, processed, transferred, disclosed, reused, corrected, restricted, or deleted each component.
Purpose and legal basis
The specific decision being made, why each data type was necessary, and whether use changed later.
Retention and deletion
Retention start, exact period or criterion, deletion date, backups, legal holds, and proof of final disposition.
Rights and repair
Dispute, correction, freeze, restriction, consent withdrawal, redaction, deletion, appeal, and human review pathways.
Cybercrime & identity-theft prevention
Secure collection is a safety control—not a convenience.
- Use a verified in-product or authenticated privacy portal with clear domain and provider identity.
- Never request passports, licenses, or facial evidence through ordinary email attachments or unexplained links.
- Minimize collection and prohibit repeated uploads without a documented reason and prior-copy disposition.
- Separate original documents from extracted data and biometric derivatives.
- Log role-based access, prevent unauthorized reuse, and make breach-response duties explicit.
- Provide a freeze or restriction pathway when compromise, misrouting, or identity theft is suspected.
Foreseeable human impact: unexplained repeated collection can cause acute distress, especially for people already notified of data breaches. Systems must reduce uncertainty with immediate receipts, plain-language status, bounded collection, and named accountability.
Originating case-study architecture
From repeated collection to a universal safeguard.
These patterns describe governance failures without alleging misconduct by an unidentified person. The standard exists so no provider can collect citizenship documents and biometrics while leaving the subject unable to trace their disposition.
Repeated document uploads
- Observed pattern
- A license or passport is submitted multiple times after unclear or contradictory failure messages.
- Required control
- The system must disclose whether each image was received, why repetition was necessary, whether older copies remain, and the disposition of every submission.
Failure followed by face collection
- Observed pattern
- A primary document is rejected or does not meet criteria, yet the interface advances to a face or liveness scan.
- Required control
- The negative state must stop escalation unless receipt, separate purpose, comparison target, vendor, retention, and renewed affirmative consent are disclosed before capture.
A positive face cannot cure a negative document
- Observed pattern
- A face comparison or liveness event succeeds while the license or passport remains failed.
- Required control
- The attempt remains not verified. The biometric record is quarantined or deleted unless a new valid document and new consent establish a lawful positive path.
No meaningful custody response
- Observed pattern
- The subject asks where documents and scans went but receives generic policy language rather than an account-specific record.
- Required control
- Provide the exportable session history, component statuses, vendors, access events, derived data, retention, disclosures, deletion status, and accountable owner.
Verified closure test
The evidence lifecycle closes only when the subject can see it.
A provider must be able to answer these requirements for the specific account and verification attempt—not with generic policy language alone.
- 01Every submission and collection event is listed with its date, channel, session, and report ID.
- 02Document status and biometric status are separately resolved without contradictory labels.
- 03Every provider, vendor, subprocessor, reviewer, custodian, and recipient is identified.
- 04Original files, extracted fields, biometric derivatives, and risk signals are distinguished.
- 05Purpose, consent, comparison target, disclosure, and reuse are documented.
- 06Retention, restriction, redaction, deletion, backups, and legal holds are explained.
- 07The subject receives written confirmation and an auditable permanent custody report.
Platform & regulatory adoption
Require a complete, exportable identity-document and biometric chain of custody before sensitive verification can be considered trustworthy.
Adopt with permanent attribution →A user-side record can preserve submission evidence and expose unanswered gaps; it cannot inspect a provider’s private servers or prove undisclosed use. The provider and its vendors must supply the authoritative custody, access, retention, and deletion records.