How Sekyro AI handles identity data
What each person sees, who can access what, and what is recorded. Formal commitments — certifications, hosting, retention periods — will be published once approved.
How to read this page
Describes how the product worksPending approval
We only publish a security or compliance claim once its owners have reviewed it.
Depending on who is looking
Identity data does not follow the same access rules on every surface. Each one shows only what it needs.
The person being verified
- Sees only what their journey needs.
- Never sees scores, thresholds, registry records or other people’s identity.
- An NNI already bound to the session is not shown in the browser.
- Reads a data notice built into the journey, with expandable terms.
The organization’s teams
- Access the dashboard according to their role.
- Lists mask identifiers; detail views show authorized data.
- Evidence opens only for authorized roles, and every view is recorded.
Ibtikar staff
- Use an identity and console separate from customers’.
- Open a read-only support view, time-limited and marked by a banner.
- Access to personal data is a separate permission, recorded in the audit log.
- Being staff creates no membership in a customer organization.
Integrations
- Each API key belongs to one app and one environment.
- The secret is revealed once; after that, only its prefix is visible.
- A key can be rotated or revoked from the app.
Who can do what
A person can belong to several organizations, with a different role in each. Organization roles and Ibtikar staff roles are separate.
| Action | Admin | Developer | Reviewer | Compliance officer | Viewer |
|---|---|---|---|---|---|
| View sessions, usage and audit | |||||
| Configure apps, platforms and profiles | Not allowed | Not allowed | Not allowed | ||
| Create hosted links and campaigns | Not allowed | Not allowed | Not allowed | ||
| Create, rotate or revoke API keys | Not allowed | Not allowed | Not allowed | Not allowed | |
| Invite and manage members | Not allowed | Not allowed | Not allowed | Not allowed | |
| See evidence and decide reviews | Not allowed | Not allowed | Not allowed | ||
| View member information | Not allowed | Not allowed | Not allowed |
Scroll the table sideways
What is recorded
Audit log
Who did what, to which object, in which environment — in plain language and filterable.
Evidence views
Every evidence view is recorded, and evidence links expire after 15 minutes.
Review decisions
A human decision keeps its reason, author and date. It stays separate from a check result.
Support view
Ibtikar opening a support view is audited, shown throughout, and ends on its own.
Published once approved
This information will be published here once its owners approve it. We prefer an incomplete page to an unverified claim.
- Pending approval
Certifications and compliance
Approval: Compliance owner
- Pending approval
Hosting and data location
Approval: Engineering and security
- Pending approval
Retention periods
Some identity references can be used beyond a session (returning people): the wording will be approved before publication.
Approval: Legal owner
- Pending approval
Sub-processors
Approval: Legal owner
- Pending approval
Incident handling
Approval: Security
Report a security issue
Think you have found a vulnerability? Write to us and choose the “Security” subject. Please don’t include real personal data.
Let’s talk about your verification journey
Describe your service and the people you need to verify. The Sekyro AI team helps you choose an integration and opens your Sandbox access.