> ## Documentation Index
> Fetch the complete documentation index at: https://docs.soverage.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy & Security

> Privacy guarantees and data handling

Soverage Gateway is built around one principle: **prove identity without storing identity**. This page explains the privacy guarantees built into the system.

## Privacy-first by design

Traditional identity systems collect and store personal data in centralized databases. Soverage takes a fundamentally different approach: no personal data is retained at any point in the verification flow.

This is not a policy decision. It is an architectural constraint. The system is designed so that PII cannot be stored, even by whoever deploys it.

## Data lifecycle

| Stage                    | What happens                                                      | What is kept                    |
| ------------------------ | ----------------------------------------------------------------- | ------------------------------- |
| Document upload          | Image analyzed in memory                                          | Cryptographic commitment (hash) |
| Email/phone verification | One-time code validated via third-party processors (e.g. Twilio)  | Cryptographic commitment (hash) |
| Device attestation       | [WebAuthn](https://www.w3.org/TR/webauthn-2/) challenge completed | Hashed credential ID            |
| DID creation             | Identifier anchored on-chain (own consensus topic)                | DID document (public)           |
| Credential issuance      | VC signed and delivered to user                                   | Nothing server-side             |
| Token minting            | Personhood Token created on-chain                                 | Token ID (public)               |

In every case, the original data (document image, email address, phone number) is discarded after verification completes.

## What is stored where

| Layer       | What is stored                                                                           |
| ----------- | ---------------------------------------------------------------------------------------- |
| On-chain    | Wallet address, DID document, verification flag, attestation hashes, Personhood Token ID |
| Client-side | Wallet session, DID keys, Verifiable Credential, attestation records                     |
| Server-side | Nothing (no PII retained after verification)                                             |

No personally identifiable information is written to the ledger or any database. There is no centralized database of user identities.

## What credentials contain

Soverage credentials include:

* A DID (public identifier)
* A personhood score
* Attestation types completed
* A cryptographic proof

They do **not** contain any personal data (name, date of birth, document number, email, phone). The credentials confirm that a real person was verified without revealing who they are.

## Cryptographic commitments

Instead of storing personal data, Soverage generates one-way hashes (cryptographic commitments) that prove a verification occurred. These commitments are recorded on-chain and can be independently verified.

This enables selective disclosure: users can prove specific claims without exposing the underlying data.

## Self-sovereign control

User credentials are cryptographically theirs. Soverage cannot:

* Revoke a user's DID
* Modify their credentials
* Access their private keys
* Prevent them from using their issued proofs

The DID and VC are portable. They can be verified by any system that supports [W3C Verifiable Credentials](https://www.w3.org/TR/vc-data-model/) and [DIDs](https://www.w3.org/TR/did-core/), independent of Soverage infrastructure.