Quick answer:
You own your data. APLYiD only uses it to provide our services. Data is encrypted and hosted on AWS in Sydney (NZ and AU) or Dublin (UK), and APLYiD is ISO/IEC 27001:2022 certified.
A completed verification is archived 1 hour after the report is first downloaded, or 7 days after completion if no one downloads it. Your client's personal data is then deleted and can't be recovered, so download and save the report straight away.
This guide is for APLYiD Core (support.aplyid.com).
Ownership and use
Who owns the data?
You do. APLYiD stores and processes your data to provide our services, but we don't use, sell, market to or share it for any other purpose. Your records are kept separate from other businesses' records, and other businesses can't see them.
What data do you collect from my clients?
Depending on the check, we collect:
name, address and date of birth
ID document details and images, such as a driver licence or passport
a selfie video of your client's face, for face matching and liveness checks
device information, IP address and location
For the full list, see What data does APLYiD keep from a verification, and when is it deleted?
How is biometric data used?
We only collect biometric data with your client's explicit consent, and only use it to verify their identity.
Storage and security
Where is data stored?
Data is hosted on Amazon Web Services (AWS):
Region | Hosted in |
New Zealand and Australia | AWS Sydney, Australia |
United Kingdom and Europe | AWS Dublin, Ireland |
Is data encrypted?
Yes. Data is encrypted in transit and at rest, to at least industry-standard levels.
Is APLYiD certified?
Yes. APLYiD is certified to ISO/IEC 27001:2022, the international standard for information security management. Contact your Customer Success Manager for a copy of our certificate.
How is access to my account protected?
User roles: Company Admins control who has access and what each user can see. See How to add a user and choose their role.
Multi-factor authentication (MFA): every user is asked to set up MFA the first time they log in.
API access: if you integrate with APLYiD, you can limit API access to approved IP addresses and domains.
Do you use third-party providers?
Yes. We use trusted providers to deliver our services, including AWS for hosting, and data sources such as Datazoo (Australia) and Centrix (New Zealand) to verify identity details and screen against PEP, sanctions and adverse media lists. For details, see our Privacy Policy.
Retention and deletion
How long do you keep verification data?
A completed verification is archived 1 hour after the report is first downloaded (by anyone in your team or by your integration), or 7 days after completion if no one downloads it, whichever comes first. This also applies to verifications waiting for Review and to manual verifications.
You're responsible for keeping records for as long as your AML obligations require, and for having your own data retention policy. Save the PDF report in your own system as soon as the verification is complete.
What happens when a check is archived?
Your client's personal details, ID images, selfie video and the verification result are deleted from your view. You can still see the reference, your client's initials, and who downloaded the report and when. Archived checks can't be recovered by you or by APLYiD Support.
See Can I get back a check that's been archived? and What data does APLYiD keep from a verification, and when is it deleted?
How do I get a copy of my data?
Open the completed verification in Biometric > Completed and click Download to save the PDF report. See How do I download, print or share a verification report?
What happens to my data if I cancel?
Verifications are already deleted when they're archived, so download any reports you need as soon as each verification is complete.
Privacy requests
My client wants to see or delete their data. What do I do?
Your client can contact you directly, or email us at privacy@aplyid.com. We aim to respond within four weeks. You can also give your client a copy of their verification report.
Can I make a privacy complaint?
Yes. Email privacy@aplyid.com. If you're not satisfied with our response, you can contact the privacy regulator in your country: the Office of the Privacy Commissioner (NZ), the Office of the Australian Information Commissioner (AU) or the Information Commissioner's Office (UK).
I need a security questionnaire or data processing agreement completed. Who do I contact?
Contact your Customer Success Manager, or email support@aplyid.com and we'll pass it on.