Withpersona

The privacy page frames Persona as a processor acting on behalf of the organization that requested verification, with the organization retaining and controlling the submitted data. However, the accessible documents do not contain explicit ownership or licensing language about user inputs, and the binding Terms of Service were inaccessible, so ownership cannot be definitively confirmed.

The documents describe verification outcomes (e.g., 'verified'/'not verified' status and signals) being returned to the requesting organization, which can access submitted information. There is no explicit statement of who owns the generated verification results, and the Terms of Service that would govern this were inaccessible.

Both the privacy page and the security page explicitly and repeatedly state that personal data processed for verification is not used to train AI or machine learning models. This is a clear, user-favorable commitment stated in plain terms.

Persona offers configurable retention policies, field-level redaction, and API-based export/deletion, and provides a Privacy Portal for deletion requests. However, no specific retention schedule or deletion SLA is stated — retention 'varies by organization and applicable legal requirements,' and because Persona is usually a processor, deletion requests may be routed to the controlling organization rather than actioned directly.

Persona states clearly that it does not sell, share, or broker personal data processed for verification to third parties. As a processor, it returns verification outcomes to the requesting organization — which is the integral, expected function of an IDV service — and marketing-site cookie data is handled separately. The disclosed sharing is limited to what the verification service requires.

A Privacy Portal lets individuals request deletion, access, correction, and manage marketing-cookie/advertising preferences. However, because Persona acts primarily as a processor and retention is often legally mandated for fraud/regulatory purposes, the ability to opt out of core verification data collection is limited and controlled by the requesting organization, not Persona.

Persona prominently displays an extensive set of certifications and alignments — SOC 2 Type II, ISO 27001, Kantara (NIST SP 800-63), CCPA, EU-U.S. Data Privacy Framework, HIPAA, FERPA, iBeta, plus a FedRAMP Marketplace listing — and references third-party penetration tests. However, the supplied text presents these largely as logos and 'aligned with' statements, with audit reports available only on request ('reach out to your Persona account manager... for a copy of our certifications'), so independent attestation evidence is not embedded in the documents reviewed.

The documents describe automated, rule-based processing and audited human review, plus audit logs and role-based access that support enterprise oversight. However, there is no detailed disclosure of model explainability, bias testing, or transparency into the automated decision logic behind verification outcomes or fraud scoring.

The security page discloses a robust set of controls: AES-256 encryption at rest, TLS 1.2 in transit with separately-stored rotated keys, vulnerability scanning, third-party penetration testing, OWASP-aligned secure development, MFA, background checks, logical access controls, isolated/dedicated environments, and disaster recovery. A dedicated security page serves as a trust reference. No breaches or security incidents are disclosed in the supplied text, and there is no explicit bug bounty or formal incident-response SLA detailed.

Persona's model is B2B2C: individuals verify at the request of organizations, and many data controls (retention, redaction, residency, access) are configured by the paying organization rather than the end user. The documents note dedicated isolated environments for organizations 'with the most stringent requirements,' implying tiered differences, but no explicit free-vs-paid data-handling comparison is provided, and no enterprise contract was accessible.

Persona states its systems are primarily automated with minimal human oversight, and that human review of verification data occurs only when the requesting organization configures it, in which case it is role-controlled, logged, and audited. This is a favorable and reasonably specific limitation.

The supplied documents are silent on government/law enforcement data requests, subpoenas, litigation, or transparency reporting. A FedRAMP Marketplace listing and public-sector offering indicate government engagement, but no disclosure addresses how Persona responds to legal process. Silence on this topic is itself a gap, especially for a platform holding government IDs and biometric data.

Persona processes extensive PII and SPI by its nature: name, contact details, government ID images, selfies/video for facial recognition (biometric data), IP address, device signals, geolocation, and device fingerprinting. This is disclosed with a data-minimization framing and strong controls (encryption, redaction, role-based access, no selling, no training). Because highly sensitive SPI (biometric, government IDs) is collected — though with clear notice and meaningful controls — this rates YELLOW rather than GREEN.

The accessible privacy and security pages are undated, while the two dated blog posts show recent activity (one last updated May 29, 2026; one last updated January 12, 2026), suggesting current maintenance. The privacy page meaningfully addresses the product's AI/automated processing, facial recognition, and explicitly addresses AI model training. However, the binding Terms of Service and standalone Privacy Policy were inaccessible and the main privacy/security pages carry no effective date, which prevents awarding GREEN under the recency requirement.

Multiple documents were supplied (privacy page, security page, privacy portal, and two blogs), and their claims are consistent: both the privacy and security pages state no selling/brokering and no AI training, consistent encryption and residency commitments, and consistent descriptions of automated-by-default processing with audited human review. No contradictions were found across the accessible documents. Note the core binding contracts (ToS/DPA) were inaccessible, so consistency with those could not be assessed.