Data retention & deletion

How long documents are kept

Each organization has a document retention setting:

"Decided" means approved, rejected, cancelled or expired — a verification still being reviewed is never purged. When Certivant sets a short window or "no document retention" for your organization, your KYC/B settings show it read-only.

What is kept:

• The verification record itself — the decision, the score, the audit trail, the certificate and the FINTRAC "verified ID" record.
• Each deleted document leaves a tombstone: the request page shows "Deleted permanently", the date and the reason, with no picture and no data read from it.
• The reference selfie of an active Live ID enrollment stays until its face template is captured (otherwise biometric logon would stop working).

With a yearly retention, documents of verifications under active sanctions monitoring are kept while monitoring runs. A short window or "no document retention" deletes them anyway — monitoring re-screens the person's name and doesn't need the pictures.

Delete documents permanently

Members whose role has Delete documents permanently (documents.delete_permanently) can delete documents for good:

• Request page — the trash button on a document, or Delete all documents for the whole verification.
• Live ID verification window — Delete permanently on a picture received during the call.

A reason is required. The file is deleted from storage together with everything read from it (extracted fields, AI review, capture details, OCR corrections, check details that quote it). The action is recorded in the audit log (document.deleted_permanently) and starts any workflow listening to Documents deleted.

This is different from Erase applicant (owners/admins), which removes everything about the person — see below.

Data deletion requests

A person can ask you to delete the personal data you hold about them (GDPR art. 17, Québec Law 25, PIPEDA). Privacy → Data deletion requests is where those requests arrive and are handled.

Receiving requests

• Default form — in Forms, use the Data Deletion Request template, publish it and link it from your privacy policy. The person's email is confirmed with a code, and they get a reference (for example DDR-2026-0007) and an acknowledgement email.
• API — POST /api/v1/kyc/deletion-requests (scope kyc:manage).
• By hand — Record a request when someone asks by phone, email or letter.

Each request has a 30-day answer deadline; overdue requests are flagged in the list and the navigation badge.

Handling a request

Members with Handle data deletion requests (privacy.deletion_requests.manage) open the request. Certivant shows the data found for this person — matched by email, phone or name — with their KYC / KYB verifications, documents and live ID sessions. Search with other details if nothing matches.

Choose what to delete:

• Erase everything about this person — every document and file, the data read from them, live ID recordings and photos, the Live ID biometric enrollment, form answers, contact details. Irreversible.
• Delete all documents of a verification, or selected documents.
• Delete a live ID recording.

Then mark the request completed (the person is emailed), close it as no data found, or decline it with a reason (for example, identity not confirmed, or a legal obligation to keep the records). Viewers with See data deletion requests (privacy.deletion_requests.view) can follow requests without acting on them.

Audit trail

Every step is in the audit log: deletion_request.received, deletion_request.in_review, deletion_request.action_taken, deletion_request.completed / deletion_request.rejected, plus applicant.pii_erased, document.deleted_permanently and recording.deleted_permanently on the verifications concerned. The audit log is append-only and never contains the deleted data.

Automation

• Action Delete documents permanently — all documents, identity documents only, the selfie, other documents, or live-call photos. By default it only runs on decided verifications.
• Triggers Documents deleted, Data deletion request received and Data deletion request completed — for example, email your privacy officer when a request arrives.

API

All require an API key with the kyc:manage scope.