Security and Privacy Overview
IdScanly is designed for privacy-first identity document OCR workflows where document images and extracted fields must be handled carefully.
Last updated: September 11, 2026
Transport security
The website and public demo are intended to be used over HTTPS only. API integrations should always use HTTPS outside local development.
Sensitive identity data should never be placed in URLs, query strings or client-side logs.
Credential handling
API keys should remain on your backend. Client applications should call your own server, and your server should call IdScanly.
Rotate credentials if a key may have been exposed.
Processed. Never retained.
Your document has a purpose, not a place in an archive. We return the extracted data without retaining document images or personal data.
Once processing finishes, we are ready for the next image.
No image storage or processing log files.
No retention of extracted personal data.
Only broad, aggregate statistics, such as document country and type.
Only broad, aggregate statistics, such as document country and type.
Contact us about API access, secure integration and deployment.
Recommended customer controls
Encrypt data at rest, restrict access to OCR results, delete temporary files promptly and avoid storing documents longer than necessary.
Need enterprise security details?
Contact us about API access, secure integration and deployment.