Privacy Policy

1. Our role

For information that a Customer or its users submit to the Services, or that the Services generate on a Customer's behalf ("Customer Data"), VerifiedKnock acts as a processor (under GDPR-style laws) and a service provider (under the California Consumer Privacy Act, as amended by the CPRA). We process Customer Data only to provide the Services under our agreement with the Customer and the Customer's documented instructions. The Customer decides why and how its users are verified and is responsible for its own privacy notices.

If you use the Services because an organization (for example, your employer, credit union or bank) enrolled you, please contact that organization with privacy questions or requests. If you contact us, we will forward your request to the relevant Customer where we can identify it.

VerifiedKnock acts as a controller for a limited set of information: business contact and account details of Customer administrators, billing and contract records, support communications, and security logs we use to protect the Services.

2. Information we process

• Security key and passkey data: FIDO2/WebAuthn public keys, credential IDs, the authenticator model identifier (AAGUID), signature counters, supported transports, and how and where a key was enrolled (for example, supervised in-person enrollment).
• Verification records: verification requests and results (such as Match or No Match), timestamps, the site or location and reference identifiers involved, verification receipts, and staff or agent decisions recorded by the Customer.
• Help desk records: the work sign-in (user principal name) an agent enters, the Microsoft Entra object ID it resolves to, the requested action, optional ticket references, and the outcome. The pass is shown once, on the verified caller's own screen. VerifiedKnock never stores or logs the pass, and the agent never sees it.
• Administrator and staff accounts: name, work email address, organization, role, registered security keys, sign-in events, and hashed recovery codes.
• Microsoft Entra ID identifiers: when a Customer connects Microsoft Entra ID or a user signs in with Microsoft, the Microsoft tenant ID, user object ID and basic sign-in claims (such as name and username), plus identifiers of authentication methods that a help desk action touches.
• Contact and invitation data supplied by Customers: email addresses for invitations, and where the Customer provides them, phone numbers, reservation or reference numbers, and the Customer's own subject identifiers.
• Technical and security data: IP address, browser user agent and timestamps for certain events (for example, invitation claims and sign-ins), and audit events.
• Support communications you send us.

What we never receive: your private keys, fingerprints, face data and authenticator PINs stay on your security key or device. FIDO2 verification uses only public-key signatures, so biometric data never leaves your authenticator. We do not receive Microsoft account passwords.

3. How we use information

• To provide the Services: enroll security keys, perform verifications, keep records and receipts, and show results to the Customer.
• To perform help desk actions that a Customer's authorized agent requests after a successful verification.
• To secure the Services: authenticate administrators, detect and prevent fraud and abuse, and keep audit trails.
• To send service messages, such as invitations and account notices.
• To provide support, troubleshoot, and maintain and improve the reliability of the Services.
• To meet legal obligations and enforce our agreements.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not use Customer Data for advertising. We do not use Customer Data to train machine-learning models offered to others.

4. Microsoft Graph and Microsoft Entra ID data

The "VerifiedKnock Pass" application accesses a Customer's Microsoft Entra tenant only after an administrator of that tenant grants consent. It requests five Microsoft Graph application permissions: three narrow write permissions that let it manage temporary access passes, passkeys, and Microsoft Authenticator methods, and two read permissions (User.Read.All and RoleManagement.Read.Directory) that it uses only to check, before each help desk action, that the target is an enabled member account with no administrator role.

We use Microsoft Graph data only to perform help desk actions that the Customer requests (for example, issuing a one-time Temporary Access Pass or removing a lost authenticator after a verified match) to refuse actions on administrator, disabled and guest accounts, and to check that the connection works. We do not read mail, files, calendars or passwords, and we do not use Microsoft Graph data for any other purpose.

A Customer administrator can withdraw access at any time by deleting the "VerifiedKnock Pass" enterprise application in the Microsoft Entra admin center.

5. Service providers (subprocessors)

We use the following service providers to operate the Services. They may process personal information only to provide their services to us.

• Railway Corporation: cloud hosting and database storage for the Services.
• Resend: delivery of transactional email, such as invitations.
• Microsoft Corporation: Microsoft Entra ID and Microsoft Graph, used only when a Customer connects its tenant or a user chooses Sign in with Microsoft.
• Okta, Inc. (Auth0): used only for Customers that choose the Auth0 identity provider integration.

Your browser also loads web fonts from Google Fonts (Google LLC), which receives your IP address and browser information when a page loads.

We will update this list before adding or replacing a subprocessor that processes Customer Data, and Customers can contact us for notice of changes.

6. Other disclosures

We disclose personal information only: to the Customer that the information belongs to and the users it authorizes; to our service providers listed above; when required by law or valid legal process; to protect the rights, safety and security of our Customers, users, the public or VerifiedKnock; and as part of a merger, acquisition or sale of assets, subject to this Policy's protections.

7. Retention

By default, audit events, verification records and metadata of revoked credentials are deleted 400 days after they are created. Expired or used one-time items (such as invitation links, sessions, sign-in challenges, recovery links and consent states) are deleted 30 days after they expire or are used. Each Customer can change these periods within the limits the Services allow (30 to 3,650 days for records, 1 to 365 days for expired items). Deletion runs automatically every day.

A Customer's organization owner can delete an enrolled person's data. We then keep only a minimal record that a deletion happened, without the person's email address or external identifier.

When a Customer's agreement ends, we delete or return Customer Data as the agreement provides. Backup copies are deleted as backups are routinely replaced. We may keep information longer where the law requires it.

8. Security

We use technical and organizational measures designed to protect personal information, including:

• Encryption in transit with HTTPS (TLS), with HTTP Strict Transport Security.
• Security headers that restrict framing and content sniffing.
• Storing bearer tokens, session identifiers, recovery codes and one-time codes only as cryptographic hashes.
• Phishing-resistant FIDO2 security-key sign-in for administrators.
• Single-use, time-limited verification codes and links.
• Least-privilege Microsoft Graph permissions and certificate-based application credentials.
• Audit logging of security-relevant actions.

No system is perfectly secure. We do not claim any third-party security certification. If we become aware of a security incident affecting personal information, we will notify affected Customers without undue delay and as required by law. Report vulnerabilities to security@verifiedknock.com.

9. Where information is processed

VerifiedKnock is based in the United States, and we process and store information in the United States. Where the law requires safeguards for international transfers, we rely on appropriate mechanisms, such as standard contractual clauses, in our agreements with Customers.

10. Your privacy rights

California residents: under the CCPA/CPRA you may have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of the sale or sharing of personal information (we do not sell or share it); to limit the use of sensitive personal information (we use it only to provide the Services and keep them secure); and not to be discriminated against for exercising these rights. You may use an authorized agent. We will verify requests before acting on them and respond within the time the law requires.

Individuals in the European Economic Area, the United Kingdom and other places with similar laws may have rights to access, correct, delete, restrict or object to processing, to data portability, and to complain to a data protection authority. Where we act as a controller, we rely on performance of a contract, our legitimate interests in operating and securing the Services, and compliance with legal obligations.

Where we process your information on behalf of a Customer, we will refer your request to that Customer and help it respond. To make a request, email support@verifiedknock.com.

11. Children

The Services are intended for business use. They are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.

12. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy here with a new effective date. If changes are material, we will notify Customers in advance by email or in the Services.

13. Contact us

VerifiedKnock Inc., 5301 Audubon Park Ct, Fremont, CA 94538-3250, USA.

Privacy questions and requests: support@verifiedknock.com. Security reports: security@verifiedknock.com. Business inquiries: founders@verifiedknock.com.