Is AgeVerify EU GDPR compliant?

AgeVerify EU is designed for GDPR data minimization. Production API runs in Frankfurt, Germany; the database operates in the EU (Ireland/Germany). Identity documents and exact birth dates are not stored.

Where is AgeVerify EU data hosted?

API and worker services are hosted in the EU (Frankfurt). PostgreSQL runs on Railway Postgres. Compliance exports are stored on Railway-backed file storage. CDN edge routing uses Cloudflare.

What personal data does AgeVerify EU store?

Only verification outcome metadata: age_over_threshold, age_threshold, country_code, method, provider, assurance_level, and policy_version. No names, exact DOB, addresses, or document images.

Trust & Compliance

GDPR compliance by design

We believe digital platforms should verify age eligibility without building massive databases of identity credentials.

Trust summary: AgeVerify EU stores boolean verification results only, hosts production systems in the EU, aligns with the EU Age Verification Blueprint, and offers configurable retention modes for audit and compliance exports.

1. EU Age Verification Blueprint alignment

AgeVerify EU operates as a Relying Party (Verifier) under the European Commission's Age Verification Blueprint. Users prove eligibility via EUDI Wallet or national wallet apps; we validate trusted issuers and store only the age eligibility result.

2. Strict Data Minimization

Under GDPR Article 5(1)(c), personal data must be limited to what is strictly necessary. Traditional KYC asks for names, addresses, birthdays, and passports just to verify if a customer is over 18.

AgeVerify EU only stores the **verified result status, timestamp, method used, and policy version**. We never store names, exact dates of birth, or identity card scans in our production database.

3. 100% EU-Hosted Infrastructure

To ensure strict alignment with European privacy standards and avoid international data transfer complications, all our production systems are located in Europe:

Our API backend is hosted in **Frankfurt, Germany**, and our PostgreSQL database operates strictly within the **EU-West region (Ireland/Germany)**. Backups are fully encrypted and stored within the EEA.

4. Privacy Policy Summary

AgeVerify EU acts as a data processor for verification outcomes on behalf of your platform. We process session parameters only for the duration required to complete verification and deliver webhooks. Identity document images and exact dates of birth are never persisted in our production database.

Developers can configure per-organization retention in the dashboard. Enterprise customers can export audit evidence as CSV files stored on EU-hosted Railway infrastructure with time-limited signed download links.

5. Configurable Retention Modes

We give developers explicit control over how long verification records persist on our platform:

Minimal Mode (Default): Stores only the verification outcome, assurance level, and timestamp for billing and audit records.
Audit Mode: Retains additional system diagnostic metadata (webhook logs, attempt counts) for dispute resolution.
Strict Privacy Mode: Immediately scrubs all session parameters upon webhook delivery, keeping only an anonymized counter for billing usage.

Trust Quick Facts

🛡️ GDPR Status: Compliant
🇪🇺 Data Region: EEA (Germany/Ireland)
🧹 Document Retention: 0 days (Not stored)
🔑 API Security: SHA-256 key hashing

Active Subprocessors

• Railway (PostgreSQL database & API hosting — EU)
• Railway (API & worker hosting — EU)
• Cloudflare (CDN & static routing — Global edge)
• Stripe (Billing — Global, EU merchant of record)
• EUDI / national wallets (e.g. France Identité — high-assurance age verification)

Enterprise Exports

Request CSV audit evidence from the developer dashboard. Exports include verification sessions, webhook delivery records, and audit log entries for your organization.