Federal ID Periods run from the event in the “From” column. “Final decision” means the reviewer’s decision or, if you appeal, the appeal decision. Deletion is carried out by scheduled jobs. Periods marked [YK: retention period] are not yet set by OFIS.
| Category | Examples | From | Kept for | Why |
|---|---|---|---|---|
| Account | Email, display name, member state, country of origin, date of birth | Registration | While the Federal ID exists | To maintain the ID and apply the age rules |
| Raw verification media | Face video; document photo; photo of you holding it | Final decision | 90 days, then deleted | Needed for review and appeal only |
| Face fingerprint | Numeric template | Reaching Level 1 | While the Federal ID exists | One person, one ID |
| Face fingerprint after a fraud refusal | Numeric template | Final decision | 730 days (two years), then deleted | Deny-list against repeat attempts; period under legal review |
| Phone number | Confirmed number | Verification | While the Federal ID exists | Duplicate detection; contact for a case |
| Identity document facts (Level 3) | Document type, issuing country, keyed hash of the number; legal name and date of birth, encrypted | Level 3 decision | While the Federal ID exists | Prevent one document backing two IDs; legal identity claim |
| Consent records | Partner, attributes, granted, expiry, revoked | Approval | Until revoked or expired, then as a record for [YK: retention period] | Enforce consent; show you your history |
| Membership entitlements | Tier, valid-until, granting app, reference | Grant | While live, then as a record for [YK: retention period] | Show the effective tier; audit of grants |
| Reviewer decisions | Outcome, reason code, reviewer, time; appeal | Decision | Life of the Federal ID, then [YK: retention period] | Accountability and appeal |
| Audit log | Issuance, level changes, suspensions, revocations, partner lookups and assertions | Event | Life of the Federal ID, then [YK: retention period] | Accountability to you and to oversight |
| Service logs | IP address, user agent, request path and status | Request | [YK: retention period] | Security, rate limiting, incident response |
| Backups | Encrypted database dumps | Nightly | 14 days | Recovery |
| Closed Federal ID | The number, the fact of closure, the date | Closure | Permanently | A number is never reissued |
On closing a Federal ID
Closing deletes the face fingerprint and any raw media still held. Account data, the phone number and the identity document facts are deleted [YK: closure grace period]. Records listed as “then as a record” are kept for the stated period after closure and then deleted.
Backups
Nightly encrypted backups are kept for 14 days, so deleted data may persist in a backup for up to 14 days after deletion. [YK: backup restore policy]