Trust Center
At VerifyNow, we are committed to protecting your data with enterprise-grade security, transparent practices, and POPIA-aligned controls for South African data protection.
Regulatory Alignment
Our services are designed to support your compliance obligations under South African law. Review our POPIA Manual / Privacy Policy and PAIA Manual for the underlying policy documents.
Purpose and lawful basis
VerifyNow's default verification purpose is identity fraud prevention and fraud detection. Any other purpose must be approved and configured for the customer account before processing, and the customer must obtain and record explicit consent for that purpose.
POPIA-aligned controls
- Lawful basis for all processing
- Data minimisation principles
- Data subject rights support
- Cross-border transfer safeguards
FICA Compliance
- KYC/CDD verification support
- PEP and sanctions screening
- Audit trail maintenance
- Record retention compliance
Information Officer Registration
- Registered with the Information Regulator
- Regulator registration number 2026-002705
- Information Officer: Ruwaida Foster
B-BBEE Status
- B-BBEE Level 1 contributor
- 135% procurement recognition
- Certificate number 9449863304
Location and cross-border processing
Core application processing and private file storage are configured in Cape Town, South Africa. A selected verification service may require the minimum necessary information to be sent to an authorised provider outside South Africa. Those transfers are limited to the requested service and must be covered by the customer's authorised purpose and the applicable POPIA cross-border safeguards.
Contact privacy@verifynow.co.za for service-specific processing locations.
Our Security Approach
We employ a defence-in-depth security strategy, combining multiple layers of protection to safeguard your data at every stage of processing. Our security practices are designed to support South African regulatory requirements.
Data Encryption
- TLS 1.3 encryption for all data in transit (with TLS 1.2+ supported where required)
- AES-256 equivalent managed encryption at rest
- Automatic managed TLS certificates
Infrastructure Security
- Global edge network with DDoS protection
- Web Application Firewall (WAF)
- Bot protection and rate limiting
- Serverless architecture (reduced attack surface)
Verification Sources
To provide accurate identity verification services, we access authoritative data sources in accordance with South African law. These sources enable us to verify identity documents and personal information securely and reliably.
Our Verification Sources Include:
- Department of Home Affairs (DHA) – For South African ID verification
- Other lawful and authorised sources – As permitted under applicable legislation
Important: Verification sources are accessed under lawful authority and are not sub-processors. They provide authoritative data for verification purposes only. Some services are fulfilled using authorised third-party verification and data suppliers under their own permitted-use frameworks. VerifyNow is not a credit bureau and does not provide credit information.
Incident Notification
In the unlikely event of a security incident affecting your data, we are committed to transparent and timely communication.
Our 48-Hour Breach Notification SLA
- Customers notified within 48 hours of confirmed breach discovery
- Detailed incident report including scope, affected data, and remediation steps
- Assistance with regulatory notification requirements (Information Regulator)
- Post-incident review and preventive measures implementation
Data Retention
We retain personal information only for as long as necessary to provide our services and meet legal requirements. Full reports from ordinary single checks are not stored by default after delivery. Batch processing, consent evidence, audit records, billing records, and account data follow the retention periods below.
What we store
We keep the records needed to process a request, deliver the result, protect the service, resolve billing or support issues, and meet applicable record-keeping requirements.
- Timestamp of the check (date and time)
- Check type (e.g. Home Affairs ID, AML/PEP, bank)
- Reference ID for the check run
- Account / user that ran the check
- Credit deducted and billing reference
- Pass / fail / error outcome code
- Consent or lawful-basis record, where applicable
- IP address of the request (for security)
Batch jobs temporarily store row inputs and provider results so the batch can be processed, shown in history, and downloaded. That row data is removed when the batch result expires.
| Data Type | Retention Period | Basis |
|---|---|---|
| Ordinary single-check reports | Not stored by default after delivery | Data minimisation |
| Self-service batch inputs, row results, and result files | Up to 30 days after completion | Processing and secure result delivery |
| Large-batch source uploads | Up to 7 days | Secure intake and processing |
| Consent documents and consent evidence | 7 years under the current schedule | Consent evidence and auditability |
| Audit, billing, security, and account records | Applicable legal, accounting, security, and contractual period | Auditability and service administration |
| Payment card or bank-account payment credentials | Not stored by VerifyNow | Handled by payment processors |
Private file access: Downloads require an authenticated account and an ownership check. Download access is time-limited, and files are removed automatically when their retention period expires.
For detailed retention information, see our Privacy Policy.
Legal & Policy Documents
Review our complete legal documentation for detailed information about how we handle your data.
Privacy Policy
How we collect, use, and protect your data
Terms of Service
Terms and conditions of service use
Data Processing Agreement
Written operator agreement for business/API use
Usage Policy
Guidelines for responsible use
Information Officer Registration Certificate
Proof of Information Officer registration with the Information Regulator
B-BBEE Level 1 Certificate
Urban Luxury Brands (Pty) Ltd B-BBEE Level 1 certificate
Sub-processors
Our infrastructure partners
Information Security
Security practices and measures
Cookie Policy
How we use cookies
PAIA Manual
Access to information requests
Security & Privacy Contacts
Have questions about our security practices or need to report a concern?
Legal Entity
Company: Urban Luxury Brands (Pty) Ltd trading as VerifyNow
Registration number: 2007/013732/07
Website: www.verifynow.co.za
Contact
Privacy: privacy@verifynow.co.za / hello@verifynow.co.za
Security: security@verifynow.co.za