Security & Data: What Check ID Keeps and Where

What gets kept

Keep the check, not the card.

What a scan leaves behind, by plan. Check ID for Teams is available now. We can’t leak what we never kept.

What each plan keeps from a scan
From each scan	Free & Pro (your device / your iCloud)	Check ID for Teams (our servers)
Name, date of birth, address, ID number	Never	Never
A picture of the ID	Never	Never
Age in whole years	Yes (optional history, 7 days)	Yes
Issuing state or country, document type	Yes. From version 3.0, also the REAL ID indicator as encoded	Yes, plus the REAL ID indicator as encoded
Result, time, how it was scanned	Yes	Yes, plus venue, device and, unless the door is set to anonymous, which staff member ran it
The staff member’s decision, which barcode checks raised a flag and a score from them, whether the person matched a guest list, whether the scan was flagged as a repeat entry, and for Apple Wallet IDs the minimum age checked	Yes	Yes
Repeat-entry code (one-way, from the barcode or passport chip)	On that device, for barcode scans. Codes older than 7 days are cleared at the first scan after the app restarts.	On our servers, a keyed code, deleted after the repeat-entry window (4 hours by default). Each device also keeps its own, as in Free & Pro.

Guest lists, staff names and repeat-entry codes

Guest lists hold names on purpose. Personal guest lists live on your device or in your iCloud, and hold the names you type in, import, or choose to add from a scan. Teams guest lists live on our servers, and hold the names your team types in or imports. A scan never adds anyone to a guest list by itself.
Scan history (Free & Pro) is on by default, can be turned off in Settings, covers the last 7 days, and syncs through your own iCloud.
Teams reports don’t name employees. The verification log uses an internal ID instead of a name. The team’s console shows who ran each scan.
Repeat-entry codes are still derived from personal data, so we never call them anonymous. By default, our servers keep none for Teams venues in New Hampshire, the EU and EEA, and every country outside the US, Canada, the UK and Australia. Owners and managers can change this per venue. At those venues the device still makes its code, keeps a copy by default, and sends it with each scan for our server to discard.
Teams scan records are signed by Check ID’s server when saved, so a later change to a signed field makes the record fail its check.

Subprocessors

Where it lives, and who else handles it.

Check ID for Teams keeps its data on our servers. Team devices also keep a copy of the team’s guest lists, and hold each scan, with its repeat-entry code, until it uploads. Free and Pro scan history and guest lists stay on your device or in your own iCloud, where we can’t read them. These companies handle data as part of the service:

Subprocessors: companies that handle data for Check ID
Company	What it does
Apple	iCloud sync for Free and Pro, the App Store, Sign in with Apple and, from version 3.0, App Store ad attribution.
DigitalOcean	Hosts our servers, database and web console: Check ID for Teams data, accounts and analytics.
Cloudflare	The network in front of our servers and this website. All traffic to them, including Teams scan uploads, passes through it. It also stores an encrypted copy of our nightly database backups, which only we can decrypt.
Amazon SES	Account email, including owner summaries with scan totals.
Stripe	Web subscriptions and billing management. Card details go to Stripe, never to us.
Slack	Our internal inbox for support messages, app feedback, purchase notices and service alerts.

We never sell your data or share it with advertisers or data brokers.

Retention and deletion

How long it’s kept, and how to delete it.

How long Check ID keeps each kind of data
Data	How long
Scan history (Free & Pro)	7 days. Older entries are cleared when the app opens.
Scan records (Teams)	Two years by default. The owner can choose from 30 days to about ten years. Older records are deleted every night.
Repeat-entry codes (Teams)	On our servers, 4 hours by default. An owner can set 1 to 365 hours. Devices keep their own copy longer (see above).
Guest lists (Teams)	Until your team deletes them. A deleted entry is purged once it has gone untouched for your retention period (two years by default). An owner can erase all guest data immediately, under Export or Erase Guest Data in the app.
Activity log (Teams)	For the life of the team.
Shared report links (Teams)	Only if an owner or manager shares a report, by hand or automatically. The link works until it expires (after your retention period, by default) or is withdrawn. Our copy stays until it’s withdrawn or the team is deleted.

Deleting your account

In Check ID 3.0 or later, tap Delete Account in the app’s account settings. If you can’t, email support@checkidapp.com. You’re signed out everywhere right away, and the account is deleted after 30 days. To cancel, sign back in to the app before then and choose Reactivate Account.
If you’re the last active member of a team, its scan records, guest lists, devices, staff profiles, venues and activity log are deleted with your account. Export what you need first. If others remain, the team keeps its data, including your name on the scans you ran and your name and email address in its activity log.
We keep a permanent record that a deleted team existed: its name, when it was deleted, the email of the person who deleted it, and record counts. We also keep billing and purchase records. Neither includes scan or guest data.
Free and Pro scan history and guest lists aren’t on our servers: delete them in the app.

Deleted data can stay in our backups for about a week, until they age out. See Reliability, backups and recovery.

Encryption

What’s encrypted, and what isn’t.

In transit. The app, the web console and this website connect only over HTTPS.
On your device. iOS encrypts the app’s data when the device has a passcode (Apple’s Data Protection overview).
iCloud. Apple encrypts synced data in transit and on its servers, but not end-to-end, even with Advanced Data Protection on, because Check ID doesn’t use CloudKit’s encrypted fields (Apple’s overview).
Our servers. Check ID for Teams data isn’t end-to-end encrypted: our servers read it to run the web console. DigitalOcean says its managed databases are encrypted at rest. We also encrypt repeat-entry keys and Sign in with Apple tokens, under a secret kept outside the database.

Analytics

What our own analytics include.

We run our own product analytics: which features get used, plus scan statistics such as the result, the state and the age in years. They never include a name, birth date, address, ID number or photo. From version 3.0, the app sends an age range instead of the exact age.

Pseudonymous, not anonymous: events are grouped under a random per-install ID that changes every six months.
Raw events are deleted after 180 days. Totals built from them are kept.
This website runs its own analytics script. It records page views, how far pages are scrolled, clicks on buttons and outbound links, use of the support form and time on page, with details such as the browser, device type and referring site. Raw events are deleted after 7 days, and IP addresses are kept only as a hashed code that changes daily.
From version 3.0, we ask Apple which App Store ad, if any, led to an install. We keep Apple’s answer, and link in-app purchases to it, under a separate install ID that doesn’t change. It carries no scan data.
From version 3.0, each scan also sends the ID’s format details, such as the barcode standard version and issuer code, but none of its personal details. We store them without the sender.
From version 3.0, for signed-in Pro users, we keep usage figures, such as total scans, with the account to answer App Store refund requests.
No third-party analytics or advertising SDKs. No advertising identifier. No ads.

Audits

SOC 2

We don’t have a SOC 2 report. For a security or procurement review, email us your questions.

How Check ID protects data