Privacy policy

Effective 2026-11-11.

Who we are

Authpermit provides trust and security infrastructure. For data processed on behalf of customer organizations we act as a processor; for account and website data we are the controller.

What we process

• Account data: email, name, sign-in events, MFA settings.
• Customer data: identities, documents, biometrics, credentials, security telemetry — only as instructed by the customer and under the deployment mode they select.
• Technical data: IP address, user agent, audit records required for security.

Principles

• Data stays with its owner whenever practical; Authpermit stores only what it needs to operate, verify, audit and secure.
• We never sell personal data and never train models on customer data without explicit opt-in.
• Biometric material is isolated, encrypted under dedicated keys and deleted per retention policy.

Your rights

Access, rectification, erasure, portability, restriction and objection. Contact privacy@authpermit.app. Customers can exercise subject rights for their users through the Data & residency settings and the data API.

Retention

Account data for the life of the account plus 30 days; audit records per the customer's retention policy and legal obligations; verification evidence per configured retention.

International transfers

Region and residency are chosen per organization. Transfers rely on adequacy decisions or standard contractual clauses.