Guide · Everyone · 5 min

Data retention & privacy (persistData=false, encryption)

Control what is stored, for how long, and how it is protected.

Identity documents are personal data (PII). Collect the minimum, keep it for as short as your obligations allow, and tell applicants what you do.

Ephemeral sessions: persistData=false

Pass persistData: false in POST /api/session/init (or set it on the App). Extracted application data is then held in server memory rather than the database, and is removed after you fetch it once with GET /api/session/{id}/info. Unfetched data expires after EPHEMERAL_DATA_TTL_MS (default 24 hours).

json

{ "clientId": "acme", "flow": "KYC", "applicationId": "order-10293", "persistData": false }

You must store whatever you need from the first fetch; a second fetch returns nothing.
Memory is per process and is lost on restart, so an unfetched ephemeral session can disappear. Fetch promptly.
The session record itself (status, ids) remains so you can still correlate webhooks.

Encryption

Extracted document fields are encrypted at rest with AES-256-GCM using the KONNECT_DATA_ENCRYPTION_KEY you configure (generate with openssl rand -base64 32). Keep the key outside the database and back it up: without it encrypted data cannot be read.

Uploaded images

Document and selfie images are stored in your configured object storage (or on disk in local mode). Apply your own bucket encryption, access policy and lifecycle rules; images are served through short-lived signed links (presigned URLs).

Your responsibilities

Have a lawful basis and a retention period. For Tunisia this includes INPDP rules; for EU residents, GDPR.
Offer a way to handle access and deletion requests.
Limit who can see sessions: use read-only and manager roles.

Not legal advice

This describes how the product behaves, not what the law requires of you. Ask your counsel or data protection officer.