Data Handling & Privacy

How personal data flows through the SheerID API — what is collected, who can read it, how long it is retained, and how to delete it with the purge endpoint.

Overview

Verifying a person’s eligibility requires collecting personal data (PII), with the consumer’s consent. This page explains how that data flows through the API — what is collected, who can read it, how long it is retained, and how to delete it. For the verification service policy (consent, fraud handling, verification lifespan), see Verification Service Definition.

What data is collected

A verification collects the personal data needed to confirm eligibility — typically name, email, and date of birth, and (depending on the segment) address, phone number, organization, or government-ID details. The exact fields depend on the program’s segment; see the request schemas in the REST API reference.

Who can read personal data

Personal data is access-controlled:

Verification step responses return the subject’s data within the verification flow that submitted it.
Verification Details returns the personInfo block only to API tokens that have the Customer PII role. Tokens without it can read verification status and metadata, but not the consumer’s personal data.

Grant the Customer-PII role only to the tokens and services that genuinely need it (least privilege).

Webhooks never contain personal data

Webhook payloads carry only the verificationId and the event type — never personal data. To act on an event, your backend calls Verification Details with an appropriately scoped token. See Setting Up Webhooks.

Data retention

Retention is configured per account in MySheerID by an Account Owner, and a program can override the account default. Changes apply only to data collected after the change is made.

Data	Default	Configurable to
Personal data (PII)	400 days for accounts onboarded on or after May 1, 2024; 730 days for earlier accounts	30, 90, 400, or 730 days
Uploaded documents (assets)	7 days after document review completes	7, 30, 400, or 730 days

After the retention period the data is purged automatically. For the full set of settings, see Data retention and privacy settings.

Deleting data on demand

To purge a single verification’s personal data before its retention period elapses, call the purge endpoint:

POST /rest/v2/verification/<VERIFICATION_ID>/purgePersonData HTTP/1.1
Host: services.sheerid.com
Authorization: Bearer <YOUR_ACCESS_TOKEN>

Requires an API token whose user has the Account Owner or Customer Service Manager role on the account that owns the verification.
Purges the personal data and expires the verification.
Runs asynchronously — it usually completes within about 5 minutes.

For consumer data-subject requests (for example, deletion under privacy regulations), use this endpoint where appropriate and contact SheerID support; see Verification Service Definition for policy details.

SheerID collects data only after the consumer opts in. The “remember me” flow (rememberConsumer) stores a consumer’s details for a faster return experience only with their consent — the request is rejected if consent is not given.

Verification Service Definition — the verification service policy (consent, fraud, lifespan).
Authentication — scope API tokens to least privilege.
Setting Up Webhooks — events carry no personal data.
Data retention and privacy settings — configure retention in MySheerID.