Biometric Authentication Without Storing Biometrics

You can change a password. You cannot change your face. If a database of face images or face templates leaks, the harm is permanent. That is why biometric data gets special treatment in law.

Under the Nigeria Data Protection Act 2023, biometric data used to uniquely identify a person is treated as sensitive personal data. That brings tighter rules on the lawful basis for processing, and a stronger duty to protect it. The regulator is the Nigeria Data Protection Commission. Take legal advice on your own position.

The best way to lower that burden is to hold less of it. Data you never store cannot leak from you.

It means no face images, no face templates and no feature vectors on your servers or the vendor's servers. It is an architecture choice, not a promise.

Capture on the device

With Veris Capture, the face is processed on the user's phone. Quality checks, liveness and signing all happen there. The image is handed to your app and to no one else. Veris servers do not receive it during capture.

Read documents on the device

With Veris Scan, the document is read on the phone. No image is uploaded to be read.

Compare in memory, then delete

Face matching needs two images on a server. With Veris Compare, the images are processed in memory for one request, sent over an encrypted connection to a processing partner that does not retain them, and never written to disk or logged by Veris. They are deleted at the end of the request, including when it fails.

Keep the evidence, not the face

What your backend keeps is a signed result, a score, a decision and a time. The signed result carries a one-way hash of the captured image, which ties the result to a capture but cannot be turned back into a face.

Not storing biometrics at the vendor does not remove your duties. Be honest about these.

• Your app receives the image. After capture, the face image is in your app. Decide what happens to it: use it for the comparison, then discard it. Do not write it to disk, logs, crash reports or analytics.
• Your server sees the images you send to Compare. Hold them in memory, send them and drop them. Redact request bodies in your logging.
• You still need a lawful basis and a clear notice. Tell users what you collect, why and for how long. Take advice on consent and on whether an impact assessment is needed, since biometric processing is the kind that is likely to be high risk.
• You still keep a record of decisions, in a form that contains no images.

For the backend pattern, see Document Verification API Design. For the compliance checklist, read NDPR Compliance for Identity Verification: A Developer's Guide. The NDPR it covers has since been succeeded by the NDPA.

• A smaller breach surface. There is no face database to steal.
• A shorter answer to the regulator. "We do not store it" is easier to defend than "we store it securely".
• Lower cost. No encrypted biometric store to build, back up, audit and eventually delete from.
• Easier procurement. Partner banks and enterprise customers ask where the face data goes.

If you start by storing face images "just in case", you build the store, the access controls, the retention rules and the deletion process, and you take on the risk for as long as the data exists. Moving off that later is far harder than never starting.

• On-device capture and scanning, so no face image reaches Veris during those steps.
• Compare that handles images in memory and deletes them after every request.
• Signed results your server verifies, so you keep evidence without keeping faces.
• A free sandbox to check all of this yourself, then flat plans from free.

"Can we really authenticate without storing a template?" For verification at onboarding and step-up, you compare a live capture with a document photo or with a fresh image the user supplies, so you do not need a stored template. If your use case needs matching against a stored face each time, you need your own lawful, secure way to hold it, and that is a decision to make with advice.

"Are hashes biometric data?" A one-way hash of an image cannot recreate a face, which is why it can sit in a signed result. Ask your counsel how your regulator views it in your case.

"Does Compare use a third party?" Yes, images pass over an encrypted connection to a processing partner that does not retain them. Check our privacy policy for the subprocessor details.

Map where a face image exists in your current or planned flow: phone, server, logs, backups. Then remove every place that is not strictly needed.

Create your free Veris account · Free to start · no card · all three products. See the security page and the NDPA page.