Data processing agreement

This agreement applies where Hawk Ai processes personal data on your behalf. You are the controller; Hawk Ai is the processor. It forms part of the terms of service.

Subject matter and duration

Hawk Ai processes personal data to verify identities on your instruction, for as long as your account exists, plus the retention periods below.

Nature and purpose

Identity document authentication, face comparison and liveness, sanctions/PEP/adverse-media screening, e-mail phone and device intelligence, public digital-footprint matching, decisioning, case management and audit logging.

Categories of data subject

Applicants you ask to verify, and your own operators who use the console.

Categories of personal data

Identity data, identity document images and extracted fields, biometric data (a selfie and its comparison to the document portrait), contact data, device and behavioural signals, public social profile data, and screening results. Biometric data and screening results are special-category data in several jurisdictions.

Your instructions

We process only on your documented instruction. Your configuration in the console — which checks run, thresholds, retention, rules — is that instruction. We will tell you if an instruction appears to breach data protection law.

Four decisions cannot be instructed away, and you should treat this as a limit on your own configuration rather than a feature: a confirmed sanctions match, a document with tampering indicators, an apparently under-age applicant, and a required check that did not run will each block automatic approval no matter how the tenant is configured.

Confidentiality

Access is limited to people who need it, under confidentiality obligations, with role-based permissions and an audit record of every read of an applicant's record.

Security measures

• Passwords hashed with scrypt; session tokens are HMAC-signed and revocable
• Two-factor authentication (TOTP) available for every operator
• Personal data fields encrypted at rest with AES-256-GCM under a key separate from the session-signing key
• Transport encryption in front of the service; webhook payloads signed with HMAC-SHA256 over timestamp.body
• Role-based access control with five roles, and API keys scoped to named permissions
• Tenant isolation enforced on every query, not by convention
• Audit log covering decisions, configuration changes and reads of applicant records
• Outbound webhook targets rejected if they resolve inside our own network
• Rate limiting on authentication, sign-up and applicant submission

Sub-processors

Verification providers (document, liveness, screening, intelligence, footprint) become sub-processors only when you connect them, and which ones is your choice. This deployment's current state is on the service status page. We will give notice before adding a sub-processor of our own and you may object.

International transfers

Where data leaves its region of origin, the transfer relies on the Standard Contractual Clauses or an adequacy decision, together with the technical measures above.

Assisting you

We will help you respond to data subject requests, and provide the information you need for a data protection impact assessment. The console exports an applicant's record, and POST /v2/applicants/{id}/erase deletes one with a reason recorded.

Personal data breach

We will notify you without undue delay after becoming aware of a breach affecting your data, with what we know, what we are doing, and what we recommend.

Deletion and return

• Document images: erased 90 days after the decision by default (documentRetentionDays). The applicant record and the decision trail survive — you must be able to show *why* you approved somebody years later without still holding their face.
• Applicant records: erased after the record retention window, default 2,555 days (~7 years) (retentionDays), which is the usual AML floor. Decisions keep their row but lose the link to a person who no longer exists.
• Both sweeps run automatically every six hours and write a tombstone to the audit log.
• On termination: exportable on request, then deleted, except where law requires retention.
• Audit records are retained for their own period, because a deletable audit trail is not an audit trail.

Audits

On reasonable notice, and no more than once a year unless a regulator requires otherwise, we will answer a security questionnaire and provide the evidence we hold. We do not currently hold a SOC 2 or ISO 27001 report — see security and trust for what that means in practice.

Contact

hello@ai-sns.io