Trust Center
At VerifyNow, we are committed to protecting your data with enterprise-grade security, transparent practices, and POPIA-aligned controls for South African data protection.
Regulatory Alignment
Our services are designed to support your compliance obligations under South African law. Review our POPIA Manual / Privacy Policy and PAIA Manual for the underlying policy documents.
Purpose and lawful basis
Every request requires a documented lawful basis, prescribed reason, or other valid processing authority. The default platform purpose is identity fraud prevention or fraud detection. Biometric photos used for another purpose require a clear notice and voluntary, specific, and informed consent when consent is the required authority.
POPIA-aligned controls
- Lawful basis for all processing
- Data minimisation principles
- Data subject rights support
- Cross-border transfer safeguards
FICA Compliance
- KYC/CDD verification support
- PEP and sanctions screening
- Audit trail maintenance
- Record retention compliance
Information Officer Registration
- Registered with the Information Regulator
- Regulator registration number 2026-002705
- Information Officer: Ruwaida Foster
B-BBEE Status
- B-BBEE Level 1 contributor
- 135% procurement recognition
- Certificate number 9449863304
Location and cross-border processing
All temporary private-file storage and primary application request execution take place in Cape Town, South Africa. Isolated image rendering takes place in Johannesburg. AML, PEP and sanctions matching and its publisher-derived dataset run in Frankfurt, Germany; submitted screening fields are processed transiently there and are not retained as a customer portfolio. Global edge security and managed Redis services can process limited technical and time-limited idempotency records outside South Africa. The current sub-processor register identifies the affected information and contractual safeguard.
Contact privacy@verifynow.co.za for service-specific processing locations.
Our Security Approach
We employ a defence-in-depth security strategy, combining multiple layers of protection to safeguard your data at every stage of processing. Our security practices are designed to support South African regulatory requirements.
Data Encryption
- TLS 1.3 encryption for all data in transit (with TLS 1.2+ supported where required)
- AES-256 equivalent managed encryption at rest
- Automatic managed TLS certificates
Infrastructure Security
- Global edge network with DDoS protection
- Web Application Firewall (WAF)
- Bot protection and rate limiting
- Serverless architecture (reduced attack surface)
Verification Sources
To provide accurate identity verification services, we access authoritative data sources in accordance with South African law. These sources enable us to verify identity documents and personal information securely and reliably.
Our Verification Sources Include:
- Department of Home Affairs (DHA) – For South African ID verification
- Other lawful and authorised sources – As permitted under applicable legislation
Driver's Licence Verification
VerifyNow reads the PDF417 barcode and returns its card-sourced fields and low-resolution portrait. Identity Verification can compare the encoded identity with the returned South African identity record. Home Affairs Face Match compares the licence portrait with the official identity photo. Licence Identity Cross-Check also compares a current selfie and reports Passive Liveness as separate evidence.
Driver's Licence Verification detailsVehicle Licence Disc Scanner
VerifyNow processes the PDF417 barcode within its hosted vehicle-disc workflow. When glare blocks the barcode, visible printed fields can be recovered and labelled with a lower confidence. Number plate comparison reports use their stated vehicle lookup source.
Image scans add available printed GVM, tare, test date and seating values by default. Source and confidence evidence stays attached to every supplemented field.
Vehicle Licence Disc Scanner detailsImportant: Verification sources are accessed under lawful authority and are not sub-processors. They provide authoritative data for verification purposes only. Some services are fulfilled using authorised third-party verification and data suppliers under their own permitted-use frameworks. VerifyNow is not a credit bureau and does not provide credit information.
Incident Notification
In the unlikely event of a security incident affecting your data, we are committed to transparent and timely communication.
Our 48-Hour Breach Notification SLA
- Customers notified within 48 hours of confirmed breach discovery
- Detailed incident report including scope, affected data, and remediation steps
- Assistance with regulatory notification requirements (Information Regulator)
- Post-incident review and preventive measures implementation
Data Retention
We retain personal information only for as long as necessary to provide our services and meet legal requirements. Full reports from ordinary single checks are not stored by default after delivery. Batch processing, consent evidence, audit records, billing records, and account data follow the retention periods below.
Number Plate Lookup is a stored-report feature. Completed Comprehensive Vehicle Check reports are kept in the authenticated user's report history so the PDF can be downloaded again. They remain subject to the account, contract, deletion, and retention controls that apply to that customer.
What we store
We keep the records needed to process a request, deliver the result, protect the service, resolve billing or support issues, and meet applicable record-keeping requirements.
- Timestamp of the check (date and time)
- Check type (e.g. Home Affairs ID, AML/PEP, bank)
- Reference ID for the check run
- Account / user that ran the check
- Credit deducted and billing reference
- Pass / fail / error outcome code
- Consent or lawful-basis record, where applicable
- IP address of the request (for security)
Batch jobs temporarily store row inputs and provider results so the batch can be processed, shown in history, and downloaded. That row data is removed when the batch result expires.
| Data Type | Retention Period | Basis |
|---|---|---|
| Ordinary single-check reports | Not stored by default after delivery | Data minimisation |
| Number Plate Lookup report history | While retained in the authenticated customer account, subject to the applicable contract and deletion process | Report re-download and support |
| Self-service batch inputs, row results, and result files | Up to 30 days after completion | Processing and secure result delivery |
| Large-batch source uploads | Up to 7 days | Secure intake and processing |
| Consent documents and consent evidence | 7 years under the current schedule | Consent evidence and auditability |
| Audit, billing, security, and account records | Applicable legal, accounting, security, and contractual period | Auditability and service administration |
| Payment card or bank-account payment credentials | Not stored by VerifyNow | Handled by payment processors |
Private file access: Downloads require an authenticated account and an ownership check. Download access is time-limited, and files are removed automatically when their retention period expires.
For detailed retention information, see our Privacy Policy.
Legal & Policy Documents
Review our complete legal documentation for detailed information about how we handle your data.
Privacy Policy
How we collect, use, and protect your data
Terms of Service
Terms and conditions of service use
Data Processing Agreement
Written operator agreement for business/API use
Usage Policy
Guidelines for responsible use
Information Officer Registration Certificate
Proof of Information Officer registration with the Information Regulator
B-BBEE Level 1 Certificate
Urban Luxury Brands (Pty) Ltd B-BBEE Level 1 certificate
Sub-processors
Our infrastructure partners
Information Security
Security practices and measures
Cookie Policy
How we use cookies
PAIA Manual
Access to information requests
Security & Privacy Contacts
Have questions about our security practices or need to report a concern?
Legal Entity
Company: Urban Luxury Brands (Pty) Ltd trading as VerifyNow
Registration number: 2007/013732/07
Website: www.verifynow.co.za
Contact
Privacy: privacy@verifynow.co.za / hello@verifynow.co.za
Security: security@verifynow.co.za