Identity Verification & Biometrics Policy

AICS Solutions · Ontario, Canada · Version 1.0 · 23 August 2026 · Draft — pending review by counsel

The short answer. When a host asks a signer to verify their identity, we collect a photograph of their government ID and (optionally) a selfie. A person compares them by eye. We do not use facial recognition, we do not measure or map anyone’s face, and we do not create or hold a biometric template or database. The images are encrypted while stored, only the host of that session can open them, and they are destroyed as soon as the host makes their decision. What remains is the outcome of the check — not the photographs.

1. Who this is for

This policy is written to be handed to the people who are asked about it: a signer who wants to know what happens to a photo of their driver’s licence, and the property manager, mortgage broker, real estate agent or attorney who has to answer them. It describes the Video Signing Room’s optional identity check only. Everything else the Service does is covered by the Privacy Policy and the Privacy Impact Assessment.

2. We do not process biometric information

This is the most common question, so it is answered first and plainly.

No facial recognition. Nothing is matched automatically. A human being looks at the ID photo, the selfie and the signer’s live video, and decides.
No biometric identifiers are generated. We do not compute face geometry, a faceprint, a template, a hash of a face, or any other measurement derived from a person’s body. A photograph is not a biometric identifier, and a photograph is all we hold.
No biometric database exists. There is nothing to search, match against, or disclose.
No liveness detection, and no automated matching of a person. Your face is never measured, scored or matched against anything, by us or by anyone acting for us.
Optional automated check of the document only. A host may switch on an automated check of the ID card itself — whether it is genuine, and whether its printed details agree with its own machine-readable data. Where a host uses it, the ID image is disclosed to our verification partner Didit for that purpose alone. It performs no facial recognition, no liveness detection and no face matching for us, and returns a verdict about the document, never about the person. Where a host does not use it — the default — no image is disclosed to any identity-verification service.

Because of this, our position is that we do not create a database of biometric characteristics and the disclosure obligation in section 45 of Quebec’s Act to establish a legal framework for information technology is not engaged. Authenticating a document does not change that: nothing derived from a person’s body is computed, stored or compared at any point. Should we ever add automated facial matching, we would treat it as a new processing activity: express consent obtained separately for it, disclosure to the Commission d’accès à l’information before it goes into service, and this policy rewritten first.

3. What is collected, and why

What	Why
A photograph of a government-issued ID (front)	So the host can satisfy themselves that the person signing is who they say they are.
A selfie (optional, at the host’s discretion)	To compare against the ID photo and the live video.
The outcome, the reviewer, and the time	The evidentiary record that the check happened.

Identity verification is optional per session. A host may instead confirm identity personally on camera, which collects no images at all.

4. Necessity and proportionality

Before collecting this information we considered less intrusive ways of achieving the same purpose. This section records what was considered and why the current design was chosen.

Alternative considered	Outcome
Collect nothing; rely on the invite link alone	Adopted as the default. Identity verification is off unless the host turns it on for a session, so most signings collect no ID at all.
Host confirms identity personally on live video	Adopted and supported in the product. A host who already knows the signer, or who is content to rely on the recorded video, can confirm identity without any image being uploaded.
ID photo only, no selfie	Adopted. The selfie is optional. Where the live video already shows the signer’s face, a separate selfie adds little.
Keep the images on file for a fixed period	Rejected as the default. The images exist to support one decision. Holding them afterwards adds risk without adding purpose, so they are destroyed when the decision is made. A host with a professional obligation to retain identity evidence may opt in per submission and must record the reason.
Automated facial recognition / liveness detection	Rejected. Disproportionate to the purpose. It would create biometric information where none exists today, engage a materially heavier regulatory regime, and introduce documented accuracy disparities across skin tone, age and gender into a decision that a qualified professional is already making on the record.
Verify through a third-party identity vendor	Rejected for now. It would send a signer’s ID to a further processor and, in most cases, to another country, to replace a judgement the host is professionally competent to make.

5. Where it is stored, and who can see it

Stored in Canada, on our servers.
Encrypted at rest with AES-256-GCM. The key is held outside the database, so access to the database alone does not yield readable images.
Only the host of that session can open them. Every request is authenticated and checked against ownership of the session. Other guests cannot see them; other accounts cannot see them.
Not sent to any AI provider, and never used to train anything.
Transmitted over TLS.

6. How long they are kept

Destroyed as soon as the host makes their decision — verified or rejected. This is the default and requires no action from anyone.
If the host asks the signer to submit again, the images are kept until they are replaced, because they are still in use.
If a session is abandoned and no decision is ever made, the images are destroyed automatically within 24 hours.
A host whose profession requires them to retain identity evidence may opt in, per submission. They must record the reason, and that reason is written to the session’s audit trail. Retained images still expire on the account’s retention period.
Destruction removes the file and clears its reference. Where a file cannot be removed, the record is not marked as destroyed — we do not report a destruction that did not happen.

7. The audit trail

Each session keeps a record that the host can export. For identity verification it captures the submission and the decision: who submitted, when, from what device and IP, who reviewed it, what they decided, the reason given, whether the images were destroyed or retained (and why), where the images were stored, and that the comparison was made by a person rather than by facial recognition. The signer’s consent is recorded in the same trail.

8. Consent

Before joining a signing session, a signer is shown what will be collected, that a person — not facial recognition — will compare it, how long it is kept, and their rights. They must tick a box and choose to join; declining ends the session for them. The consent, and the moment it was given, are recorded. Before uploading, they are told again what happens to the images.

If the host cannot verify a signer from the photographs, the signer may be asked to submit again or to confirm their identity another way. A signer may ask the host for an alternative method at any point.

9. We do not sell this information

We will never sell, rent, trade or otherwise profit from a signer’s identity images or verification result, use them for marketing, or use them to infer anything about a person. They are used only to complete the signing they were collected for.

10. Your rights

Under PIPEDA and, for Quebec residents, Law 25, you may ask what we hold about you, have it corrected, withdraw your consent, request a machine-readable copy, or have it deleted. Requests are answered within 30 days and are free. See your rights and Delete your account & data.

11. If something goes wrong

A confidentiality incident affecting identity information is recorded in our incident register, assessed for risk of serious injury, and where that risk exists we notify the affected individuals and the Commission d’accès à l’information, together with any other regulator the law requires. See the PIA for the full procedure.

12. Contact

Questions about this policy, or a request about your information, go to our privacy officer: ezpdfeditor@aicanadiansolutions.ca.

13. Status of this document

This is a draft prepared for review by legal counsel and is provided for information. It is not legal advice, and it does not replace the professional obligations of a host using the Service. A French version will be published for Quebec.