Data Storage Policy

Understand How Attestr Stores and Processes Personal Data

Before integrating or using the KYC and verification services provided by the Attestr Platform, it is important to understand how end user personal data is collected, processed, stored, shared, and governed within the platform ecosystem. Attestr is designed with a privacy-first and consent-driven architecture to help clients implement compliant verification workflows aligned with the requirements of the Digital Personal Data Protection Act, 2023 (DPDPA 2023) and other applicable data protection regulations. The following sections explain the consent framework, data processing principles, storage policies, lifecycle controls, and compliance measures implemented by Attestr to ensure secure, transparent, auditable, and purpose-bound handling of personal data across all KYC and verification operations.

There are three primary categories of information processed within the Attestr Platform as part of KYC, verification, consent, and compliance workflows:

1. Request Data - This includes the actual end user information submitted for verification and the corresponding verification or KYC response data returned by the platform. This category may contain personal information and Personally Identifiable Information (PII) related to the end user, including identity details, contact information, government identifiers, verification outputs, and associated response attributes required for the requested service. Storage of Request Data is conditional and depends on the selected Consent Type, permitted Consent Operations, and the applicable consent validity duration. Depending on the consent configuration and authorized processing scope, Request Data may either be processed transiently for one-time verification or securely retained for recurring workflows, reporting, audit, compliance, and retrieval purposes. The following sections explain the storage, retention, and processing behaviour associated with different consent models in detail.
2. Request Metadata - This includes operational and transactional information associated with a verification request. This typically consists of the unique request identifier, request timestamp, product or service code, requesting member or application ID, credit or usage counters, processing information, and the associated consent_id used for the request. Request Metadata is primarily used for system operations, auditability, monitoring, billing, and traceability purposes and does not contain end user PII data.
3. Consent Metadata - This includes information related to the consent lifecycle and consent governance process, such as consent timestamps, validity period, consent type, consent mode, consent purpose, supported operations, data categories, lifecycle events, revocation history, and expiration details. This category also includes two client-provided fields — DataPrincipalId and ClientObtainedByUserId — which may qualify as Personally Identifiable Information (PII) depending on the identifiers used by the client within their systems.

Request Metadata and Consent Metadata are retained in an active, queryable format for a period of up to 1 year from the consent registration date to support consent lifecycle tracking, auditability, compliance verification, and operational workflows. After this period, the metadata may be migrated to an archived storage system and retained for a maximum total duration of up to 3 years, subject to applicable legal, regulatory, compliance, and platform retention policies.

Data Handling Behaviour by Consent Type

Attestr supports 2 types of consents - Single Use Consents , Reusable Consents. Read more about single use and reusable consents at Consent Type definitions.

Single Use Consent Data Handling

For Single Use Consents, Personally Identifiable Information (PII) fields present in the request payload are masked in a non-retrievable format and retained only as part of limited request transaction metadata for audit, reconciliation, and reporting purposes. The actual Request Data submitted for verification is processed transiently to fetch the verified information and return the response to the client in a synchronous manner. The original Request Data and verification response data are not persistently stored by the platform.

Since Request Data is not retained for Single Use Consents, features requiring historical retrieval or stored verification artifacts — such as PDF report generation, asynchronous retrieval, long-term storage, export workflows, or recurring access — are not supported under this consent model.

Reusable Consent Data Handling

By default, Attestr does not store request or verification data for reusable consent–based verifications. However, this behavior can be customized through configurable data handling options.

Consent Operations

For reusable consent workflows, Attestr supports the following additional consent operations:

• Store – Enables storage of Personally Identifiable Information (PII) and verification data.
• Report – Enables generation of PDF reports.
• Export – Enables batch export operations.
• Share – Enables sharing of data with authorized third parties.

To enable data storage, consents must first be registered with the Store operation enabled.

Data Storage Configuration

Attestr provides an Enable Data Storage setting at the product level. When enabled:

• Request and verified data are securely stored in the database.
• All stored data is encrypted before storage.
• Encryption mechanisms and handling details are described in the relevant encryption section.

Default Data Retention Period

When data storage is enabled for a product, Attestr stores encrypted request and verification data for up to 7 working days at no additional cost, subject to consent validity.

The retention period is determined as follows:

• If the consent validity is less than 7 working days, data is retained only until the consent expires.
• If the consent validity is greater than 7 working days, data is still retained for a maximum of 7 working days by default.

Customizable Data Retention

Customers requiring data retention beyond the default 7 working days can request a custom retention configuration from Attestr.

Key points:

• Retention duration can be configured independently for different products.
• Extended retention requires the purchase of Data Storage Packs.
• Additional storage usage is calculated only for the period exceeding the default 7-day retention.

For example:

• If data retention is configured for 30 days, the chargeable storage duration is calculated as: 30 - 7 = 23 days
• Accordingly, 23 Data Storage counters are deducted from the purchased storage pack.
• Data continues to remain encrypted throughout the retention period and is available for retrieval as configured.

Feature Specific Behaviour

Transaction Reports

Transaction reports downloaded through the platform contain only the masked request payload and are retained for a period of one year, in accordance with the data retention policy described in the Request Metadata section above.

Branded PDF Reports

PDF reports for verifications can be downloaded through the platform or APIs only while the associated consent remains valid and active, and provided that the consent was registered with the REPORT operation enabled.

Once the consent expires or becomes inactive, the corresponding PDF reports are no longer available for download.

Batch Validations

For batch Excel-based bulk validations, consent details must be provided for each individual record included in the batch.

The EXPORT operation is mandatory for batch validation workflows, as verified records cannot be exported back into Excel format unless the consent has been registered with the EXPORT operation enabled.

During the export process:

• Only records with an active and valid consent are included in the generated Excel file.
• Records for which the consent has expired are automatically skipped and excluded from the final exported file.

Automatic Data Deletion

Attestr runs automated background job schedulers at regular intervals to enforce data retention and deletion policies.

These scheduled processes identify all stored request and verification data associated with consents that are either:

• Expired, or
• Revoked

Such data is permanently deleted from the system upon identification.

After deletion, only the associated Request Metadata and Consent Metadata are retained for audit, tracking, and compliance purposes.

Bypass Storage For Specific Verification Request

To provide additional control to platform users, Attestr supports a configurable custom request header for reusable consent workflows.

When this header is included in the API request and set to true:

• Verified output data is not stored in the Attestr database.
• Request metadata and transaction traceability continue to be maintained for audit and operational purposes.

This capability allows organisations to minimise persistence of sensitive verification results while still maintaining essential request-level tracking and compliance records, thereby enabling a more privacy-conscious approach to data handling.

xxxxxxxxxx

curl --location --request POST 'https://api.attestr.com/api/v2/public/checkx/rc' \

--header 'Authorization: Basic <API Token>' \

--header 'Content-Type: application/json' \

--header 'XAttestrSkipStore: true' \

--data-raw '{

    "reg": "KA01MB1673"

}'

Consent Revocation Policy

A Consent Revocation Policy defines the process through which a Data Principal can withdraw previously granted consent for the processing, storage, or sharing of their personal data. It also outlines how associated data is deleted or access is discontinued once the revocation request is approved and processed.

Consent Revocation for Customer-Hosted Flows

In cases where consent is collected directly from the Data Principal on the customer’s platform and subsequently registered with Attestr, the Data Principal retains the right to request consent revocation and deletion of associated data at any time.

Upon receiving such a request, the customer may revoke the consent and delete the associated stored data using either of the following methods:

• Attestr Dashboard
• Revoke Consent API

Once the revocation request is processed, all data associated with the consent and stored within Attestr systems is deleted in accordance with the configured data handling and retention policies.

Consent Revocation via Attestr Hosted Pages

When customers use Attestr Hosted Pages to collect consent directly from the Data Principal, Attestr additionally provides a self-service portal for Data Principals to view, manage, and revoke their consents.

Using the self-service portal, the Data Principal can:

• View active consents
• Review consent details and validity
• Submit a consent revocation request directly

Upon receiving a revocation request, Attestr notifies the respective customer for approval and further action. Once the revocation request is approved by the customer, all data associated with the consent and stored within Attestr systems is deleted in accordance with the applicable data retention and deletion policies.

Consent Audit Policy

Attestr provides comprehensive consent audit capabilities by allowing customers to export consent metadata and complete consent lifecycle information through the Dashboard and APIs. The exported audit records can include details such as consent creation timestamp, consent validity, consent purpose, approved operations, consent status, verification activity logs, revocation history, and associated transaction references. This enables organisations to maintain transparent audit trails, support regulatory compliance requirements, perform internal governance reviews, and demonstrate lawful processing of personal data whenever required.

Data Encryption Policy