Veridas

GDPR overview

Veridas is established in Spain, so the GDPR and the Spanish LOPDGDD apply to it directly, including for operations outside the European Union. The company publishes a designated Data Protection Officer, names the Spanish AEPD as its supervisory authority, lists the full set of data subject rights, and undertakes to sign a Data Processing Agreement with every client before any processing starts. It also claims alignment with the California Consumer Privacy Act, BIPA, Mexican and Colombian data protection law, and classifies its biometric systems as low or no risk under the EU AI Act. One caveat matters: the main privacy policy covers the corporate website only. Platform processing is governed by a separate Identity Proofing Services notice, linked but not surfaced in the navigation, and it is that document which carries the operative commitments.

Who owns the data?

For its identity proofing services Veridas always acts as a data processor, never as the controller. The client company decides what happens to end-user data, and Veridas states it never processes that data for its own purposes, acting only on the client's documented instructions. Where the platform runs outside the Veridas cloud, Veridas has no access to the data at all and is not even a processor. Veridas is a controller only for its own website data — contact forms, newsletter, cookies and job applications — under the entity Veridas Digital Authentication Solutions, S.L. A designated Data Protection Officer can be reached at the published GDPR address, and end users are directed to the client for most rights requests.

Reuse rights

End-user data is processed only to verify an identity: the platform reads the identity document, generates an irreversible biometric vector from the face or the voice, compares it with the document photo or a stored reference, and checks liveness. The evidence produced — processed images, similarity scores, integrity checks — is handed to the client, who is free to reuse it under its own privacy policy. Veridas keeps nothing and states it never trains its biometric engines on production data, using dedicated development databases instead. The demonstration mobile application follows a different regime: data captured there is kept for five years for research and development, is never commercialised, and is never made available to customers or end users.

Data retention & training

Hosting summary

By default the platform runs on Amazon Web Services infrastructure located in Germany and Ireland, which keeps processing inside the European Economic Area and means no international transfer in the sense of the GDPR. Veridas also operates AWS regions in Virginia and Oregon to serve customers based in the Americas, but states that this is only done where the Data Processing Agreement with the client provides for it. The same platform is available on Google Cloud Platform in Europe. For organisations that will not place identity data in a vendor's cloud, an on-premise deployment lets the whole platform run inside the client's own infrastructure, in which case Veridas has no access to the data and does not act as a processor at all. The participation of the cloud provider as a sub-processor is agreed in advance with the controller, and any change of provider requires the controller's authorisation. Sub-processors are disclosed by category rather than by name.