When I was designing Mallient's architecture, one decision kept coming back to me: what happens to a user's passport photo after verification is complete?

The standard answer in the KYC industry is: it gets stored. On the provider's servers. Indefinitely, or until some configurable retention window expires. The reasoning usually goes something like, "we need it for audit purposes" or "regulators might ask."

I thought that was the wrong default. So we built Mallient differently.

When a user completes a verification through Mallient, here's what happens:

What we retain is the outcome of verification, not the underlying material that got you there. Structured data: name, date of birth, document type, verification result, timestamps, check-by-check audit records. Everything a compliance team actually needs. Nothing more.

Every piece of sensitive data you store is a liability, and every piece your KYC provider stores on your behalf is a liability too. When a breach happens at a third-party vendor, it's your users whose passports are leaked. It's your brand that takes the reputational hit. It's your legal team fielding the calls.

The KYC industry has had its share of incidents. Storing millions of government-issued IDs is a high-value target. The safest document is the one that doesn't exist on any server after it's served its purpose.

If you're serving European users, Article 5(1)(c) of GDPR requires that personal data be "adequate, relevant and limited to what is necessary." Storing a passport scan indefinitely so it's available just in case isn't data minimization. It's the opposite.

Zero retention isn't a workaround for GDPR compliance. It's alignment with what the regulation actually asks for. For EU-focused fintechs, this is a meaningful risk reduction.

There's a trust dimension here that often goes undiscussed. When a user submits a selfie and a passport to verify their identity, they're expecting that data to be used for verification, not stored in a database they'll never have visibility into. Zero retention is an honest architecture. It does what users reasonably expect.

Compliance doesn't require raw images. It requires records.

Mallient retains structured verification results, extracted document fields, check-level audit logs, and timestamps. Everything needed to demonstrate that a verification was performed, what was checked, and what the outcome was. This satisfies AML record-keeping requirements without holding onto sensitive biometric material.

For clients who operate in jurisdictions that explicitly require document image retention (and some do) Mallient supports configurable retention policies. You can opt into retention where it's genuinely mandated. The point is that it's a deliberate choice, not the default.

Honestly? Because it's easier. Storing everything means you never have to think carefully about what's actually required. It gives you flexibility to add features later that might reference historical images. And there's a perception that "more data = more defensible" in a compliance audit.

But easy for the provider isn't the same as right for the customer.

The companies most exposed to the downsides of document storage are the fintechs and crypto platforms that end up in the breach headlines, not the KYC vendor that stored the data on their behalf.

Zero retention isn't a checkbox on a pricing page for us. It's a foundational architectural decision that shapes how the entire verification pipeline was built. Processing happens in a way that ensures raw material isn't persisted beyond the moment it's needed.

That decision has implications. It means we had to think carefully about what audit information is actually valuable. It means our liveness detection runs on-device, with no biometric data leaving the user's device at all, which is part of why we pursued iBeta Level 2 certification for our liveness module.

It's also why I think it's worth talking about openly. The default in this industry should probably be different. And building a KYC platform that developers and compliance teams can genuinely trust means being explicit about decisions like this one.

If you're evaluating KYC providers and data handling is a concern, whether for GDPR, security posture, or just because it's the right thing to do, I'm happy to walk through how Mallient's architecture works in more detail.

Book a demo or reach out directly.

Michael is the founder of Mallient, a developer-first identity verification API built for fintechs and crypto platforms.