Data and access
Be deliberate about verification data.
Verification involves personal information. Define what you collect, who reviews it, and how your application uses the result.

Build a clear boundary around the workflow.
- Server-side credentialsKeep client credentials in your backend. Do not expose them in browser code or applicant links.
- Workspace accessReview cases through the workspace that owns them. Share applicant verification links only with their intended recipients.
- Webhook verificationValidate signatures and timestamps before processing application events. Handle retries and revisions.
- Collection and retentionAsk our team about storage, access, retention, and deployment requirements before collecting sensitive data.