Version 1.0 · Effective November 11, 2026 · authenticate.com/dpa · Prior versions
Part of the Authenticate Customer Agreement between Authenticating.com LLC and its customer (Customer Agreement, Section 1.2). Capitalized terms not defined here have the meanings given in the Customer Agreement. Prior versions are archived on this page.
This Data Processing Agreement ("DPA") is an integral part of the Customer Agreement between Authenticating.com LLC (the "Processor") and the customer identified in that Agreement (the "Controller"), and governs processing of Personal Data performed by Processor. This DPA is effective as of the Effective Date of the Customer Agreement and is accepted by the Parties' signature to that Agreement.
1.1 Controller: the entity that determines the purposes and means of processing Personal Data. For CCPA purposes, includes "Business."
1.2 Processor: the entity that processes Personal Data on behalf of the Controller. For CCPA purposes, includes "Service Provider."
1.3 Personal Data: any information relating to an identified or identifiable natural person as defined under applicable Privacy Laws, including Sensitive Personal Data.
1.4 Sensitive Personal Data: a subset of Personal Data requiring heightened protection under Privacy Laws, including biometric data, government-issued identifiers, financial information, criminal history, precise geolocation and consumer health data.
1.5 Processing: any operation performed on Personal Data, such as collection, storage, access, retrieval, analysis, dissemination, deletion or destruction.
1.6 Sub-Processor: any third party engaged by Processor to process Personal Data on Processor's behalf, including independent contractors and contracting entities.
1.7 Privacy Laws: all data protection laws and regulations relevant to either Party, including the California Consumer Privacy Act as amended; the comprehensive consumer privacy laws of other U.S. states; BIPA; CUBI; Wash. Rev. Code 19.375; the Washington My Health My Data Act; the EU General Data Protection Regulation; the UK GDPR; and analogous laws.
1.8 Data Subject: a natural person whose Personal Data is processed by or on behalf of the Controller. For CCPA purposes, includes "Consumer."
1.9 Security Incident: has the meaning given in Section 6.6 of the Customer Agreement.
2.1 Role allocation.
| Activity | Role |
|---|---|
| Identity and background verification performed at Controller's direction, and delivery of results | Processor |
| Storage and transmission of Customer Data for the Services | Processor |
| Processing of Biometric Data for verification | Processor, subject to the Biometric Data Terms |
| Security, integrity and fraud-detection functions of the Services | Processor, for a permitted business purpose |
| Aggregated and de-identified data under Section 4.4 | Not processing of Personal Data |
| Consumer reporting agency functions under FCRA with respect to Regulated Services, including consumer disputes and file disclosure | Independent Controller |
| Controller's account administration, billing and support contacts | Independent Controller |
| Processor's own legal and regulatory compliance | Independent Controller |
2.2 Precedence. Section 4 of the Customer Agreement controls over this DPA. This DPA controls over the remainder of the Customer Agreement. The Biometric Data Terms control over this DPA with respect to Biometric Data. Where the Standard Contractual Clauses apply, they control over this DPA as to matters arising under them.
3.1 Subject matter, nature and purpose. Processor provides services related to identity verification, fraud prevention, trust and safety, risk mitigation and compliance. Processor processes Personal Data for these purposes as directed by Controller, and, with respect to Regulated Services, additionally as required of a consumer reporting agency under the FCRA.
3.2 Categories of Data Subjects. Individuals undergoing identity verification or background screening; Controller's employees, contractors, vendors or agents subject to identity-related processing.
3.3 Types of Personal Data. Biometric data, including facial geometry and liveness data; government identifiers, including driver's license numbers, passport numbers and Social Security numbers; name, date of birth and contact information; motor vehicle records, criminal history, employment, education and professional licensing data; financial account ownership data; device and network information, including IP address and geolocation.
3.4 Duration. Processing continues for the Term of the Customer Agreement and the retention periods in Section 3.5, after which Personal Data is deleted under Section 11.
3.5 Retention.
1) Biometric Data is retained and destroyed strictly in accordance with Processor's published Biometric Information Retention and Destruction Policy and the Biometric Data Terms.
2) Consumer report records. While Customer's account is Active, Controller may access through the Platform the reports furnished to it for Regulated Services. When Customer's account ceases to be Active, Controller's access to those reports ends, and Processor will not make them available to Controller, except where Processor determines that production is required by law or necessary for Controller to meet its obligations under Section 4.6 or Section 4.12 of the Customer Agreement. Controller is responsible for keeping any copies it needs for its own records under Section 4.7 of the Customer Agreement before its account ceases to be Active. Processor retains consumer report records relating to Regulated Services — the request, the identity of the requesting Authorized User, the permissible purpose certified, the End User's authorization, the Data Supplier and search performed, the report furnished, and any dispute and its resolution — for six (6) years from the date of the request, as required for Processor to meet its obligations under the FCRA, 18 U.S.C. § 2721(c) and its Data Supplier agreements. Once Customer's account ceases to be Active, those records are held in an access-restricted compliance archive and used solely for consumer disputes and file disclosure, regulatory and Data Supplier compliance, and the establishment or defense of legal claims.
3) All other Personal Data is retained only for as long as necessary for the purposes in Section 3.1, and in any event is deleted or anonymized within five (5) years of the transaction to which it relates, unless a longer period is required by law, necessary for an active fraud investigation, subject to a legal hold, or directed in writing by Controller.
4.1 Controller obligations. Controller will: (a) provide lawful instructions for processing, and warrant that those instructions do not cause Processor to violate any Privacy Law; (b) obtain and document all Data Subject consents required, particularly the written release for Biometric Data required under the Biometric Data Terms; (c) comply with Section 4 of the Customer Agreement; and (d) retain the right to request deletion, copies or modification of Personal Data as permitted by law.
4.2 Processor obligations. Processor will: (a) comply with Privacy Laws and this DPA when processing Personal Data on Controller's behalf; (b) process Personal Data exclusively for the purposes defined by Controller and not for independent purposes without prior written authorization, subject to Section 4.4 and to Processor's own obligations under the FCRA; (c) ensure any personnel or Sub-Processors accessing Personal Data are bound by written confidentiality agreements and appropriately trained; (d) implement safeguards meeting at minimum the standards in Section 6; (e) notify Controller of Security Incidents in accordance with Section 7; and (f) notify Controller promptly if it determines it can no longer meet its obligations under applicable Privacy Laws.
4.3 Prohibitions. Processor will not: (a) sell or share Personal Data for any purpose; (b) use Personal Data for purposes outside the scope of the Services, subject to Section 4.4 and Processor's FCRA obligations; (c) combine Personal Data with other datasets except as necessary to provide the Services or for fraud prevention, and only as permitted under applicable Privacy Laws; or (d) use Personal Data to train, fine-tune, develop, benchmark or improve any machine learning or artificial intelligence model, subject to Section 4.4 and never with respect to Biometric Data.
4.4 Aggregated and de-identified data. Nothing in Sections 4.2(b), 4.3(b) or 4.3(d) limits Processor's right under Section 6.3 of the Customer Agreement to create and use aggregated and de-identified data for operating, improving, securing and developing the Services. Processor will maintain such data in de-identified form, will not attempt to reidentify it except as permitted by law to test de-identification, and will contractually bind recipients to the same obligations. This Section does not apply to Biometric Data.
5.1 Use of Sub-Processors. Processor may engage Sub-Processors to fulfill the Services, including independent contractors operating on a least-privilege basis. A current list of Sub-Processors, including the jurisdictions from which each may access Personal Data, is maintained at authenticate.com/subprocessors (the "Sub-Processor List"). Controller may subscribe to change notifications there.
5.2 Notice and objection. Processor will give Controller thirty (30) days' written notice before adding or replacing a Sub-Processor. Controller may object on reasonable privacy or data protection grounds within fifteen (15) days of notice. If the objection is not resolved in good faith, Controller may terminate this DPA and the Customer Agreement as they relate to the Service involving the disputed Sub-Processor, and receive a pro-rata refund of prepaid fees for that Service.
5.3 Obligations and responsibility. Processor will ensure each Sub-Processor is bound by written agreement to data protection obligations equivalent to those in this DPA, and remains fully responsible to Controller for the acts and omissions of its Sub-Processors.
5.4 Diligence. Processor will conduct due diligence before engagement and review Sub-Processor compliance at least annually.
6.1 General. Processor will implement industry-standard safeguards for the protection of Personal Data, including encryption of data at rest and in transit using AES-256 or higher; access management controls including multi-factor authentication for sensitive system access; role-based, least-privilege access; regular penetration testing and monitoring; logging of access to Personal Data; and adherence to SOC 2 Type II standards.
6.2 Biometric Data. For Biometric Data, Processor will apply heightened safeguards, including a prohibition on using biometric identifiers for machine learning model training; detailed logging of all remote access to biometric databases; and storage, transmission and protection using a reasonable standard of care within the industry and in a manner at least as protective as that used for other confidential and sensitive information, as required by BIPA § 15(e).
7.1 Mutual obligation. Security Incidents are governed by Section 6.6 of the Customer Agreement, which applies mutually.
7.2 Processor notification. Without limiting Section 6.6 of the Customer Agreement, Processor will notify Controller in writing without undue delay and in no event later than seventy-two (72) hours after confirming a Security Incident affecting Personal Data processed on Controller's behalf, and will provide the details, updates and cooperation described in that Section.
7.3 Suspected violations. Processor will notify Controller promptly on becoming aware of any suspected material violation of applicable Privacy Laws affecting Personal Data processed on Controller's behalf.
8.1 Assistance. Processor will reasonably assist Controller in fulfilling Data Subject requests, including rights to access, delete, correct and port Personal Data; CCPA and state-law rights, including opt-out of sale or sharing, opt-out of targeted advertising, opt-out of profiling, and limitation of use of Sensitive Personal Data; and appeals of denied requests.
8.2 Timelines. Processor will respond to Controller's request for assistance within ten (10) business days, or sooner where necessary for Controller to meet a statutory deadline.
8.3 Requests received directly. If Processor receives a privacy request directly from a Data Subject, it will notify Controller within five (5) business days, will not respond substantively except to acknowledge receipt and direct the Data Subject to Controller, and will follow Controller's directions unless prohibited by law. This Section does not apply to consumer disputes or file requests under the FCRA relating to Regulated Services, which Processor handles directly as a consumer reporting agency and which are governed by Section 4.12 of the Customer Agreement.
8.4 Costs. Each Party bears its own costs of routine assistance. Where assistance materially exceeds routine support, the Parties will agree reasonable compensation in advance.
9.1 Service provider status. With respect to Personal Data processed as a Processor, Authenticating.com is a "service provider" as defined in Cal. Civ. Code § 1798.140(ag), and an equivalent "processor" under other state Privacy Laws.
9.2 Certification. Processor certifies that it understands the restrictions in Section 4.3 and this Section 9 and will comply with them. Specifically, Processor will not: (a) sell or share Personal Data; (b) retain, use or disclose Personal Data for any purpose other than performing the Services, including for a commercial purpose other than the business purposes specified in the Customer Agreement; (c) retain, use or disclose Personal Data outside the direct business relationship between Processor and Controller; or (d) combine Personal Data with Personal Data received from or on behalf of another person, or collected from Processor's own interactions with a Data Subject, except as permitted under applicable Privacy Laws for a business purpose.
9.3 Notification. Processor will notify Controller promptly, and in no event later than five (5) business days, if it determines it can no longer meet its obligations under applicable Privacy Laws.
9.4 Remediation right. Controller may, on notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data by Processor.
9.5 Sensitive Personal Data. Processor will not use Sensitive Personal Data other than for purposes permitted under Cal. Civ. Code § 1798.121 and equivalent state provisions, and will not sell Sensitive Personal Data under any circumstances.
This Section applies where Processor processes Personal Data subject to the GDPR or UK GDPR.
10.1 Article 28(3) obligations. Processor will: (a) process Personal Data only on documented instructions from Controller, including as regards transfers to a third country, unless required by law, in which case Processor will inform Controller before processing unless the law prohibits it; (b) ensure persons authorized to process Personal Data are bound by confidentiality obligations; (c) take all measures required by Article 32; (d) respect the Sub-Processor conditions in Article 28(2) and (4), as set out in Section 5; (e) assist Controller with Data Subject rights under Chapter III; (f) assist Controller in complying with Articles 32 to 36; (g) at Controller's election, delete or return Personal Data at the end of the Services, as set out in Section 11; and (h) make available all information necessary to demonstrate compliance and allow for and contribute to audits, as set out in Section 13.
10.2 Special category data. Biometric Data processed to uniquely identify a natural person is special category data under Article 9. Controller is responsible for establishing and documenting each Data Subject's explicit consent under Article 9(2)(a), consistent with the Biometric Data Terms.
10.3 Notification of infringing instructions. Processor will inform Controller if, in its opinion, an instruction infringes the GDPR, UK GDPR or other Privacy Laws.
11.1 Default retention. Personal Data is retained in accordance with Section 3.5.
11.2 Biometric Data. Governed by the Biometric Information Retention and Destruction Policy and the Biometric Data Terms.
11.3 On termination. On termination or expiration of the Services, Processor will at Controller's election delete or return all Personal Data, other than consumer report records, which are governed by Section 3.5(2), and other records Processor is required to retain under applicable law. If Controller gives no election within thirty (30) days of termination, Processor will delete all Personal Data it is not required to retain.
11.4 Backups. Where immediate deletion is not feasible, such as in backup media, Processor will isolate the Personal Data, protect it from further processing, and delete it in the ordinary backup expiration cycle. Backups are encrypted and are not restored into production or used for any purpose except disaster recovery; where a restore from a backup predating a deletion is performed, the deletion is re-applied before the system returns to service.
11.5 Certification. Processor will certify deletion in writing on request.
12.1 Locations and access. Processor stores Personal Data in the United States. Personal Data may be accessed remotely from outside the United States, including from India, by independent contractors and Sub-Processors providing engineering, operations and support services. The jurisdictions from which such access occurs are identified on the Sub-Processor List, which is incorporated into this DPA by reference and is the authoritative record of Sub-Processors and access locations.
Processor ensures all such access is: (a) structured under strict least-privilege controls; (b) logged and subject to robust access restrictions; (c) governed by written confidentiality agreements consistent with this DPA; (d) limited to the minimum Personal Data necessary, through a controlled environment such as a virtual desktop or bastion host, with multi-factor authentication and no persistent local copies; (e) subject to a prohibition on downloading, locally storing, printing or exporting Personal Data outside Processor's controlled environment; and (f) subject to background screening of personnel with access to Personal Data, to the extent permitted by local law.
All such contractors and contracting entities are Sub-Processors for purposes of Section 5 and appear on the Sub-Processor List. Additions of new access jurisdictions are subject to the notice and objection procedure in Section 5.2.
12.2 Biometric Data and consumer report data. Access to biometric identifiers, source photographs and consumer report data obtained from Processor's data sources is restricted as stated in the Sub-Processor List, which identifies for each category of data the jurisdictions from which it may be accessed.
12.3 GDPR and UK transfer mechanisms. Where Personal Data originates from the EEA or UK, Processor will ensure compliance with lawful transfer mechanisms: the Standard Contractual Clauses approved by the European Commission (Modules Two and Three as applicable) for EEA transfers, and the UK International Data Transfer Addendum for UK-originating data. Processor will conduct Transfer Impact Assessments and provide summaries on request.
12.4 Disclosure and consistency. Processor will maintain accurate disclosure of the jurisdictions from which Personal Data is accessed on the Sub-Processor List, and will keep its published Privacy Policy and Biometric Information Retention and Destruction Policy consistent with that List. Where another Processor document is inconsistent with the Sub-Processor List, the Sub-Processor List controls.
13.1 Compliance reports. Processor will provide its annual SOC 2 Type II report for Controller's review, and a summary of its most recent penetration test, on request.
13.2 Audit rights. Where the reports in Section 13.1 are insufficient to demonstrate compliance, Controller may request an audit, including third-party verification, limited to once in any twelve-month period and on thirty (30) days' written notice. Audits will be conducted during normal business hours, will not unreasonably disrupt Processor's operations, will be subject to confidentiality obligations, and will not extend to any other customer's data or to Processor's proprietary systems beyond what is necessary to verify compliance.
13.3 Questionnaires. Processor will respond to reasonable security questionnaires no more than once in any twelve-month period.
13.4 Costs. Controller bears the cost of any audit under Section 13.2 unless the audit reveals a material breach by Processor, in which case Processor bears the reasonable cost.
14.1 Mutual liability for breach. Either Party's breach of this DPA, including violations of biometric-specific laws such as BIPA, is an "Excluded Claim" as defined in Section 8.2 of the Customer Agreement, subject to the super-cap stated in that Section.
14.2 Indemnity. Each Party will indemnify the other for claims arising out of its breach of this DPA or applicable Privacy Laws, including third-party claims relating to unauthorized access to Personal Data. This indemnity is subject to the notice, control of defense, participation and settlement procedures in Section 8.1 of the Customer Agreement, and does not duplicate recovery under that Section.
15.1 Term. This DPA terminates automatically on termination of the Customer Agreement, subject to Processor's obligations under Section 11. Sections 9, 11, 13 and 14 survive termination.
15.2 Governing law. This DPA is governed by the laws of the State of Utah and is subject to the venue and jury waiver provisions of Section 11.5 of the Customer Agreement, except where a mandatory provision of applicable Privacy Law, or the Standard Contractual Clauses incorporated under Section 12.3, requires otherwise.
15.3 Changes in law. If a change in Privacy Laws renders any provision of this DPA insufficient, the Parties will negotiate in good faith an amendment to restore compliance.
15.4 Execution. This DPA requires no separate signature. It is incorporated into the Customer Agreement under Section 1.2 and is accepted by the Parties' signature to the Customer Agreement. A countersigned copy is available to Controller on request to privacy@authenticating.com.
This is the first published version of this document. When it is updated, prior versions will be archived here.