How Are ID and Biometric Images Protected During Verification?

When your driver’s license and face are scanned, who keeps the images, and for how long?

At Stile, captured ID images stay available while verification or manual review needs them. A final decision triggers deletion. AWS may process images for supported checks, and other biometric records follow separate retention rules.

You may be renting a car, opening an account, or completing identity verification. You deserve to know what happens to the images you handed over.

In September 2026, Brian Krebs reported on Nexus, a service advertised on the Russian cybercrime forum Exploit that claimed to offer more than 153 million U.S. and Canadian driver’s licenses. His investigation connected some available scans to earlier identity checks, and he reported that the FBI had opened an investigation into the source. The full scope and cause remained unresolved. Read Krebs’s reporting.

For us, the lesson is that an identity check creates a second responsibility: protecting what the person hands over.

We’re building Stile around that responsibility. We encrypt ID images before they reach storage, restrict access while verification or review needs them, and trigger deletion after the final decision. Each choice is intended to reduce the sensitive images left behind and limit what an attacker could recover from a compromised system.

Keep ID images only while the check needs them

An image of your license can contain your face, name, date of birth, address, and document number. Keeping a copy after its purpose is complete leaves that information available to a future compromise.

Stile keeps captured document images and extracted document information while verification or an open manual review needs them. A final verification or review decision triggers their deletion.

If someone leaves a verification unfinished, the session expires and scheduled cleanup removes its captured images. Closing the browser does not itself trigger immediate deletion. Images needed for manual review remain available while the review is open. A configured deadline leads to automatic rejection and image cleanup if the review remains unresolved.

Verification results and some sensitive hashed identifiers can remain. Other information collected during the workflow follows its own retention rules. Those records have different purposes and lifetimes from the original ID image. The deletion triggers described here cover active capture storage; they do not promise that every backup or processing-provider copy disappears at the same instant. Stile’s data retention guide.

For information about requesting access to or deletion of your data, see our privacy notice.

Encrypt images before they reach storage

Getting access to a stored file should not immediately reveal someone’s ID. That is why we add protection before the image reaches AWS.

Stile encrypts captured ID images using AES-256-GCM. Amazon S3 then applies a second encryption layer through AWS Key Management Service.

When we retrieve an image from AWS, it is still encrypted. Our application key is needed to turn it into a readable photo.

Access to the stored object alone therefore does not yield the ID image. AWS supports using application-side and server-side encryption together. AWS encryption documentation.

Control who can process and view the images

To compare an ID portrait with a selfie, a verification service needs images it can read. Protecting that step means securing the connection and controlling which services and people can access those images.

AWS’s face-comparison API accepts image inputs, and Rekognition uses HTTPS to protect communication in transit. Storage encryption does not prevent the authorized service from processing the image. AWS face-comparison API and encryption documentation.

ID scans, selfies, and biometric templates also have different lifecycles. On Stile’s AWS liveness path, the stored result excludes the returned reference and audit images. That limits what Stile keeps in that result record. AWS may still retain input needed to provide its service, and other biometric data follows its own retention policy.

The business requesting a check receives the verification outcome through our standard integration. That response does not include the original ID photos, reducing the need for the business to maintain another image repository.

If a check needs manual review, an authorized reviewer can view the necessary evidence through a restricted review workflow. Review-image access is recorded in an audit log.

For readers evaluating the checks themselves, the DHS remote identity validation framework examines document validation, presentation attack detection, and selfie-to-document matching. Its findings concern verification performance; protecting the images used in those checks requires the additional controls described here.

Limit use beyond the verification

Submitting an image for verification raises another question: can the processing provider use it to train models?

We configure AWS to opt out of using verification content for service improvement, including model training. The opt-out limits that additional use of images supplied to complete a check. Verification processing and operational retention remain separate. AWS AI services opt-out policy.

Plan for a compromise during verification

The Nexus operators reportedly claimed that they were continuing to extract new records. That allegation matters because an attacker may target images as they arrive, as well as images already in storage. Krebs’s reporting.

If an attacker copies an image during processing, deleting it later cannot recover that copy. If a compromised application is authorized to retrieve and decrypt images, storage encryption alone cannot stop it. Protecting the application and its key remains essential.

These controls address different risks: readable stored files, access during processing, unnecessary copies, and extended retention. We do not know enough about the incident to claim that a particular Stile control would have prevented it. Our aim is to reduce those exposures throughout the verification.

People hand over an ID to complete a specific check. They deserve to know what happens to that image afterward.

That responsibility shapes how we’re building Stile: what we collect, which systems can process it, who can access it, and when it is removed. Read our data retention guide for those boundaries, including what remains after the images are deleted.

For more on the risks of collecting identity documents, read When Identity Verification Creates More Risk.

Vlad Marinov is the co-founder and CTO of Stile.