WhoYou applies controls across capture, transmission, processing and storage, including authenticated access, encryption, least-privilege permissions, isolated environments, monitoring and audit logging. The exact controls relevant to a client should be confirmed during security and implementation review.

Data in transit is protected using TLS and stored data is encrypted using AES-256, with role-based access controls and detailed audit trails.

Raw biometric inputs are transformed into secure templates for matching and processed in isolated environments. The platform is designed to retain only the information required for the verification and audit process, subject to the configured service and retention rules.

WhoYou provides security, controlled access, auditability and configurable verification journeys that can support a POPIA-aligned process. The client remains responsible for establishing a lawful purpose and basis, giving appropriate notices, minimising collected data, handling data-subject rights and setting defensible retention rules.

WhoYou enables isolated environments, role-based access and least-privilege controls intended to prevent unauthorised access across clients and services. Any shared fraud-intelligence capability should have separately defined governance, access and lawful-processing rules.