Retention schedule · §13.5(d)
How long a liveness result is kept
Before a recording is made, the person at the device is asked to confirm that they are present. The Standard requires the Register to publish how long the result of that check is held, and to destroy it on that schedule. This is that schedule. It takes effect on 29 September 2026.
The schedule
| What | Where it is held | How long |
|---|---|---|
| The result of the check: verified or not verified, the time, and the method used | By the Register, as a private field of the Record. It is never published. | Five years from the date of the check. It is then destroyed. |
| A commitment to the result | In the chain file that forms part of the Deposit. It is a fingerprint made with a random value, and the result cannot be recovered from it. | As long as the Deposit, which is never destroyed (§9.4). It holds no result and identifies no one. |
| Any image, voice sample or other data used in the check | Nowhere. It is discarded when the check returns and never retained beyond the session (§13.5(b)). | None exists after the check. |
| A copy of the result held by a party | By the party, if they saved one. | Each party is asked to destroy it on the same date. The Register cannot compel this. |
What this means
Destroying the result changes nothing else. The Deposit, its hash and the Record are unchanged. The chain still verifies from its commitments after the result has gone; what is lost is the ability to show, after five years, what the check returned. Permanence attaches to Records, not to the artifacts used to verify them (§13.5(d)).
No biometric identifier is created. The check is not an identity check and does not compare anyone to a template. No biometric identifier or biometric information is created, collected, stored, converted to a template, disclosed, sold, leased, traded or otherwise profited from (§13.5(a)).
The person is told first. Before any check, the person is informed in writing that a check will be made, of its purpose, that nothing is retained beyond the result, and of the period on this page, and gives a written release (§13.5(c)). A person may decline. A Session in which someone declines cannot be captured at Tier 1, and the Record states the tier the Session did reach.
Where the law is stricter, it governs. If the law where a participant lives imposes a stricter requirement, the Register applies it or declines the check rather than perform it non-compliantly (§13.5(e)).
Changes. A change to this schedule is published on this page with its date. It does not lengthen the period for a check already made.
Questions about this schedule: contact@rootandbranchregister.org.