Data and access

Be deliberate about verification data.

Verification involves personal information. Define what you collect, who reviews it, and how your application uses the result.

Verification profiles listed in the Credflare workspace
The real Credflare workspace, shown with fictional demo data.

Build a clear boundary around the workflow.

  • Server-side credentialsKeep client credentials in your backend. Do not expose them in browser code or applicant links.
  • Workspace accessReview cases through the workspace that owns them. Share applicant verification links only with their intended recipients.
  • Webhook verificationValidate signatures and timestamps before processing application events. Handle retries and revisions.
  • Collection and retentionAsk our team about storage, access, retention, and deployment requirements before collecting sensitive data.