Data minimisation, retention, export and deletion workflows are part of the schema.

Identity verification stores provider references and results only. Raw identity documents must remain with the qualified verification provider unless a separate legal and security review requires otherwise.

Optional analytics require consent and can be disabled through cookie preferences.