We do not store your customers' ID documents

If you send us a KTP and a selfie, we read them, return the result, and keep nothing.

That sentence is easy to write and hard to verify, so here is what it actually means in practice.

No copy, not "deleted quickly"

Our identity endpoints never write your images to storage at all. Not to a bucket with a short retention rule — never written.

The difference matters. A "delete after one day" rule is asynchronous and day-granular, so an ID card can sit on a disk for closer to forty-eight hours. Not writing it is immediate and needs no rule to be remembered, configured, or audited.

If you upload a file to get a URL, that upload is deleted as soon as the endpoint has read it — including when the call fails, which is exactly when a forgotten file is least likely to be noticed.

No face database

There is no gallery, no index, no vector store of the faces you send. Every comparison is between the two images in that one request.

This is why we do not offer one-to-many search: it would require keeping the faces. Deciding not to build that is what keeps the promise cheap to honour.

Field values never reach our logs

Our usage records store the endpoint, the cost, and whether it succeeded. They do not store NIK, name, address, or any other field read from a document.

Where you stand legally

Under UU No. 27 Tahun 2022, when you send us data about your own customers, you are the Pengendali (controller) and we act as your Prosesor. We process it only to answer the request you made, never for our own purposes and never to train anything.

That relationship is written into our terms — not just described in a privacy notice — because the document you accept should be the document that governs it.

Biometric data is data pribadi yang bersifat spesifik and carries a higher standard. We treat it that way, and we expect you to have a lawful basis, normally the person's explicit consent, before sending it.

What we deliberately do not claim

We return measurements, not verdicts. A similarity score and the threshold it was measured against — never "this person is verified".

There is no liveness check, so a photograph of a photograph can match. Saying that plainly is more useful to you than a confident-sounding result that cannot support the weight you would put on it.