Security & data handling

Two separate data planes

Identity data (verification outcomes, districts, attestation dates) lives in a vault schema reachable only by server-side service credentials — never by the app’s public or member-facing database roles. Product data (bills, positions, tallies) lives separately and carries no legal names or addresses from verification. The only member-chosen public string on the entire platform is a display name you type yourself.

What we store — and what we never store

We never store ID images, selfies, or any biometric data.
We never store your document number. We store a keyed one-way fingerprint of it (HMAC-SHA256, key held outside the database) that cannot be reversed to the number. Its only use is preventing one document from verifying two accounts.
Your attested address is used transiently to resolve your districts, then cleared. Only district codes survive.
Publicly, geography is district-level only — never an address or ZIP.

Verification provider retention

Verification runs on Stripe Identity. Stripe retains the verification session — including captured document and selfie images on Stripe’s side — for up to approximately 12 months before scheduled redaction, which is disclosed in the consent screen before you verify. We schedule redaction of each session after that window; we do not claim instant removal, because that would be false. This window also powers duplicate detection that protects the integrity of every district count.

You can delete your account at any time from your own page. Deleting asks Stripe to redact every verification session we hold for you — the same redaction described above, requested immediately rather than waited out, and still bounded by Stripe’s side of it rather than ours. It destroys anything you uploaded for manual review from our storage, and removes your account, your positions, and your verification record — including the fingerprint of your document number — from our storage. On our side we keep nothing: no tombstone, no retained fingerprint, no record that you were ever here. Your positions leave every count, so the tallies they were part of go down. You may verify again from scratch afterwards; because your positions are gone too, doing so gives you one record and not two.

Access & infrastructure

Row-level security on every product table; members can read only their own rows; the public reads only published aggregates and opted-in named positions.
All secrets (signing keys, API keys) live in platform environment configuration, never in the database or the repository.
Point-in-time database backups are enabled; two consecutive failures of a scheduled job email the operator.

Contact

Security reports and data questions: ian@brandhousedental.com (interim address until the public entity’s domain launches).