<story><title>Stripe Identity</title><url>https://stripe.com/identity</url></story><parent_chain><item><author>pc</author><text>(Stripe cofounder.)&lt;p&gt;&amp;gt; &lt;i&gt;Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents.&lt;/i&gt;&lt;p&gt;A few points:&lt;p&gt;- Fundamentally, Identity makes it possible to choose how much of this data traverses &amp;#x2F; is stored on your servers, just as Stripe did with card numbers.&lt;p&gt;- There&amp;#x27;s a basic difference between card numbers and identity verification. With card numbers, you (generally) don&amp;#x27;t really care about the number -- you just want the payment. With ID verification, however, many businesses have good reason to want more than just the verification result. For example, they are often subject to compliance requirements that mandate that they themselves possess or have access to the raw information. They may need or wish to perform additional checks on their side. Etc.&lt;p&gt;- The relevant UI in Identity is deliberately very clear on this points in order to avoid the assumption you&amp;#x27;re stating. The flow explicitly says &amp;quot;Stripe and [Business] may each use your data.&amp;quot; Even though an end user might consider it suboptimal for the business to have their data, we still view it as an improvement to the usual status quo, where this data is frequently stored in very ad hoc fashion and without rigorous security protections.&lt;p&gt;- While many of the businesses initially building on Identity &lt;i&gt;wanted&lt;/i&gt; access to the raw information, it may well make sense for us to enable them to restrict themselves in the future. In this world, Stripe could tell their customers that the business doesn&amp;#x27;t have access to the raw details. (This might even make sense for Stripe payments in the future.) As a philosophical matter, we consider ourselves to serve &lt;i&gt;the business&lt;/i&gt;, which means that limiting access to what we consider to be the business&amp;#x27;s own information feels a bit strange. That said, it might sometimes be in the interests of the business to allow them to limit themselves in this fashion (especially as Stripe&amp;#x27;s brand recognition among consumers grows).&lt;p&gt;- There&amp;#x27;s a separate concern about compromise of the business&amp;#x27;s credentials leading to inadvertent disclosure of this information (a situation analogous to an S3 bucket key getting leaked). This is of general concern to us in lots of situations, not just with Identity. We have some new functionality on the way here.</text></item><item><author>agwa</author><text>Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents.&lt;p&gt;That would be an incorrect assumption.  Per &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;support.stripe.com&amp;#x2F;questions&amp;#x2F;managing-your-id-verification-information#data-access&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;support.stripe.com&amp;#x2F;questions&amp;#x2F;managing-your-id-verifi...&lt;/a&gt; customers of Stripe Identity have API access to &amp;quot;captured images of the ID document, selfies, extracted data from the ID document, keyed-in information, and the verification result&amp;quot;.&lt;p&gt;Thus, when you use Stripe Identity to verify your identity, you have to trust that:&lt;p&gt;1. The website doesn&amp;#x27;t download, retain, and later leak your selfie and identity information.&lt;p&gt;2. The website&amp;#x27;s Stripe API token isn&amp;#x27;t compromised and exploited by identity thieves to access your selfie and identity information.&lt;p&gt;Stripe appears to be leaning heavily on their claim that they don&amp;#x27;t disclose &amp;quot;biometric identifiers&amp;quot; to websites and that these &amp;quot;biometric identifiers&amp;quot; are deleted from their systems within 48 hours. This is extremely deceptive considering that biometric identifiers can be reconstructed from the selfie.</text></item></parent_chain><comment><author>agwa</author><text>Thanks for your reply.&lt;p&gt;&amp;gt; &lt;i&gt;Fundamentally, Identity makes it possible to choose how much of this data traverses &amp;#x2F; is stored on your servers, just as Stripe did with card numbers.&lt;/i&gt;&lt;p&gt;There&amp;#x27;s a stark difference in how Stripe treats exports of card numbers versus exports of raw identity verification data.  This makes it way easier, and more likely, for Stripe customers to choose to store raw identity verification information.&lt;p&gt;&amp;gt; &lt;i&gt;With ID verification, however, many businesses have good reason to want more than just the verification result. For example, they may be subject to compliance requirements that mandate that they themselves possess or have access to the raw information. They may need or wish to perform additional checks on their side. Etc.&lt;/i&gt;&lt;p&gt;I acknowledge that some businesses have a need for this.  But I see Discord and Clubhouse among your customer logos, and your product page talks about non-KYC use cases.  Many of your customers will have access to identity documents without really needing it.  That sucks for the end users of Stripe Identity, because it makes it more likely their data will be misused.&lt;p&gt;A concrete suggestion: make it possible for businesses to choose whether they have access the raw data, and expose the choice to the end user in the Stripe Identity flow.  Ideally, businesses that want the raw data would be subject to security compliance requirements.  This is an opportunity for Stripe to be a leader in setting high standards on how this type of data should be handled.</text></comment>
<story><title>Stripe Identity</title><url>https://stripe.com/identity</url></story><parent_chain><item><author>pc</author><text>(Stripe cofounder.)&lt;p&gt;&amp;gt; &lt;i&gt;Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents.&lt;/i&gt;&lt;p&gt;A few points:&lt;p&gt;- Fundamentally, Identity makes it possible to choose how much of this data traverses &amp;#x2F; is stored on your servers, just as Stripe did with card numbers.&lt;p&gt;- There&amp;#x27;s a basic difference between card numbers and identity verification. With card numbers, you (generally) don&amp;#x27;t really care about the number -- you just want the payment. With ID verification, however, many businesses have good reason to want more than just the verification result. For example, they are often subject to compliance requirements that mandate that they themselves possess or have access to the raw information. They may need or wish to perform additional checks on their side. Etc.&lt;p&gt;- The relevant UI in Identity is deliberately very clear on this points in order to avoid the assumption you&amp;#x27;re stating. The flow explicitly says &amp;quot;Stripe and [Business] may each use your data.&amp;quot; Even though an end user might consider it suboptimal for the business to have their data, we still view it as an improvement to the usual status quo, where this data is frequently stored in very ad hoc fashion and without rigorous security protections.&lt;p&gt;- While many of the businesses initially building on Identity &lt;i&gt;wanted&lt;/i&gt; access to the raw information, it may well make sense for us to enable them to restrict themselves in the future. In this world, Stripe could tell their customers that the business doesn&amp;#x27;t have access to the raw details. (This might even make sense for Stripe payments in the future.) As a philosophical matter, we consider ourselves to serve &lt;i&gt;the business&lt;/i&gt;, which means that limiting access to what we consider to be the business&amp;#x27;s own information feels a bit strange. That said, it might sometimes be in the interests of the business to allow them to limit themselves in this fashion (especially as Stripe&amp;#x27;s brand recognition among consumers grows).&lt;p&gt;- There&amp;#x27;s a separate concern about compromise of the business&amp;#x27;s credentials leading to inadvertent disclosure of this information (a situation analogous to an S3 bucket key getting leaked). This is of general concern to us in lots of situations, not just with Identity. We have some new functionality on the way here.</text></item><item><author>agwa</author><text>Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents.&lt;p&gt;That would be an incorrect assumption.  Per &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;support.stripe.com&amp;#x2F;questions&amp;#x2F;managing-your-id-verification-information#data-access&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;support.stripe.com&amp;#x2F;questions&amp;#x2F;managing-your-id-verifi...&lt;/a&gt; customers of Stripe Identity have API access to &amp;quot;captured images of the ID document, selfies, extracted data from the ID document, keyed-in information, and the verification result&amp;quot;.&lt;p&gt;Thus, when you use Stripe Identity to verify your identity, you have to trust that:&lt;p&gt;1. The website doesn&amp;#x27;t download, retain, and later leak your selfie and identity information.&lt;p&gt;2. The website&amp;#x27;s Stripe API token isn&amp;#x27;t compromised and exploited by identity thieves to access your selfie and identity information.&lt;p&gt;Stripe appears to be leaning heavily on their claim that they don&amp;#x27;t disclose &amp;quot;biometric identifiers&amp;quot; to websites and that these &amp;quot;biometric identifiers&amp;quot; are deleted from their systems within 48 hours. This is extremely deceptive considering that biometric identifiers can be reconstructed from the selfie.</text></item></parent_chain><comment><author>jart</author><text>Do you verify when a business downloads our identity documents from your servers that they&amp;#x27;re only doing so to meet regulatory requirements? What promise do we have you&amp;#x27;re not just making it as easy as possible to obtain drivers licenses, passports, birth certificates, etc. so that every little monster who has something we want will start making it a requirement? Have you considered how your service might impact trans people or undocumented citizens?</text></comment>