A business asked you to verify your identity through Veriflow

Who Veriflow is, and who asked you

Veriflow (Pty) Ltd is a South African company, registration number 2023/584644/07. We build the software that businesses use to verify identity, bank account and company details.

We did not choose you. A business you were dealing with decided to run a verification, chose which one, and chose you as the person to verify; we carried out the verification it asked for.

This page cannot tell you which business it was, because the same page serves every business that uses Veriflow. The flow you were sent should name the business asking. If it did not, stop and ask before you continue.

Two things we are not

• We are not a credit bureau. Veriflow is not registered as a credit bureau under section 43 of the National Credit Act 34 of 2005 and does not conduct business as one. We report nothing about you to any credit bureau or to the National Credit Register. Where a result came from a registered credit bureau, that bureau, not Veriflow, is the author of that information, and its own dispute process is the one that can correct it.
• We are not a regulator, and we hold no official status. Veriflow holds no registration, licence, accreditation, authorisation, certification or approval from any regulator or standards body in respect of what it does, and does not hold itself out as holding any. A verification result is not a certificate.

What we were asked to confirm

Which of these ran on you depends entirely on what the business asked for. Only it can tell you. In plain terms, a verification can:

• confirm that a South African ID number exists on the Department of Home Affairs record and return the details held against it (name, date and place of birth, sex, marital status, whether the person is recorded as deceased, and the date the ID was issued), so the business can compare them with what you gave it;
• compare a selfie with the latest Home Affairs photograph for that ID number and return a probability that the two match; the business sets the probability it accepts;
• test whether a living person moved their face into the frame, rather than a printed photograph, a screen or a recording, and return a pass or fail result;
• return the contact information a credit bureau record holds against an identity number (phone numbers, known addresses and email addresses, each one date-stamped so its age is visible), for the business to compare with the details you gave it;
• confirm that a bank account exists and is registered to the name and identity number given, and answer a few questions about the account itself: whether it has been open for more than three months, whether it accepts debits and credits, and whether a mobile number matches the one the bank holds for it;
• return a credit score and risk rating held against an identity number in credit-bureau data, where the business has a lawful purpose for asking;
• indicate the three days of the month on which collections against a person’s accounts have most often succeeded, ranked. That is a pattern drawn from history. It is not your salary date, and it says nothing about what you can afford;
• find whether a public-service employment record exists for an identity number, and return the department recorded, not what the person earns;
• confirm details a company or its directors have registered with the Companies and Intellectual Property Commission (CIPC), including which directorships are recorded against an individual’s identity number; and
• screen a name against politically exposed persons (PEP), and against published sanctions and money-laundering watchlists, in one verification.

Each one has its own page setting out what it confirms and, just as importantly, what it does not: the full catalogue is here.

What a verification never asks for. No verification needs your banking password, a card PIN or a payment from you. If you are asked for these, stop.

What happens to your information

The result goes back to the business that asked for it, and we keep a record that the verification ran.

Veriflow uses verification data only for the verification itself: results are not cached for reuse, your verification is not matched against verifications run for other businesses, no analytics are run on verification data, and it is not used to build, train or improve any Veriflow product, model or dataset.

What it is used for, and what it is not

Where your face was used, the purpose is narrow and it is the only purpose: to compare, one to one, the person in front of the camera with the latest Home Affairs photograph for that identity number, and to detect a spoof: someone holding up a photograph of you or playing a video of you.

• One comparison. Your selfie is compared against one record only: the latest Home Affairs photograph for the identity number given. It is not searched against a collection of faces, and it is not used for anything else.
• No index of faces. Veriflow does not keep a searchable index of faces, and does not run one-to-many searches.
• No facial template kept. Veriflow does not keep a facial template that could be used to recognise you in a different business’s verification, or to link what one business knows about you to what another knows.

That is all. Your face is not used to work out your age bracket, your mood, your race, your health or anything else about you, and it is not used to decide whether you are trustworthy.

Who receives it

• The business that asked for the verification receives the result. It decides what happens next.
• The source the verification has to ask. Running a verification means sending an identifier (an identity number, an account number) to whoever holds the answer: the Department of Home Affairs, the CIPC, a registered credit bureau, a bank or government payroll records. Home Affairs receives the identity number in order to return the record held for it. It does not receive your photograph.
• Our service providers (the parties that host, secure and support the platform, and the parties that help us obtain the answer from those sources) process information on our behalf, under contract.
• Your information is not shared with other businesses that use Veriflow, is not sold, and is not shared with advertisers or data brokers.

Your face is treated differently in law

Veriflow treats facial images, facial comparison data and liveness recordings as special personal information under the Protection of Personal Information Act (POPIA). The law is strict here: biometric information may not be processed at all unless one of a short list of legal grounds applies.

The business has to hold that ground before your face may be processed, and it must be able to tell you which one it is. You are entitled to ask. It may be your permission; it may instead be that the processing is necessary to establish, exercise or defend a right or obligation in law. Which one applies to you is a question for the business, not for us.

How long information is kept

The business that asked for the verification sets how long its verification records are kept, as a retention period on its verification flow. The records, including any selfie or photograph taken during the verification, are kept for that period and then deleted automatically, and the business can delete a record sooner, for example when you ask it to. POPIA also sets a limit: information may not be kept for longer than is necessary for the purpose it was collected for, unless a law requires or allows longer. You can ask us what we hold about you at any time, and asking costs nothing. See your rights below.

Your rights under POPIA

These are yours whether or not you are anyone’s customer, and you do not need a lawyer to use them. In summary, you have the right:

• to be told that your information is being collected, where it came from, what it is for and who receives it;
• to ask whether we hold information about you, and to get a copy or a description of it. Being told yes or no is free. Only the record, or a description of it, may be charged for, and only after we have given you a written estimate in advance, which you are free to turn down;
• to have information corrected or deleted where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, and to be told in writing what was done. We answer as soon as possible;
• to have processing restricted while the accuracy you dispute is being looked into. Disputing it is enough to start that;
• to withdraw your permission where permission is what was relied on. That is directed to the business, not to us, because the business is the party relying on it. Withdrawing does not undo processing that lawfully happened before; and
• not to be subject to a decision based solely on automated processing where it affects you to a substantial degree. This is the right a human step in the business’s own process is there to protect.

This is a summary. The business that asked for the verification must give you its own privacy notice; our PAIA manual sets out how to make a request to us and what we have to do with it.

How to use them, and who answers

Write to our Information Officer at support@veriflow.co.za, marked for their attention, or by post to 51 Ingersol Road, Lynnwood Glen, Pretoria, 0081. There is no charge for asking whether we hold information about you. Where you ask for the record itself, any prescribed fee is set out in the PAIA manual and you get a written estimate first. We will ask you for adequate proof of identity before we act, because acting on an unverified request would itself be a disclosure to the wrong person. For a formal records request, our manual under the Promotion of Access to Information Act (the PAIA manual) sets out the procedure and the timetable.

Which of us answers depends on why we hold your information, and the difference is real:

• Where a business asked us to verify you, we act as that business’s operator. We will assist, and we will pass your request on to that business, and tell you that we have done so.
• Where your name appears in the published sanctions and money-laundering watchlist data we keep copies of, there is no business to pass anything on to, because no business asked us to hold it. There, we are the responsible party and we answer you ourselves.

If something is wrong, or you did not expect this

• You did not expect the request. Contact the business you think sent it, using contact details you already have, not the details in the message. A flow that will not tell you which business is behind it is a reason to stop.
• You have a question about the face step. Your selfie is compared once with the latest Home Affairs photograph for your ID number, to see how closely the two faces match, and it is not used for anything else. Whether the step is part of the verification is the business’s decision, so ask it. Where it relies on your permission, that permission has to be voluntary, specific and informed, and asked for separately from any other terms. A pre-ticked box is not permission.
• You think the information is wrong. For a verification a business asked for, tell the business, and tell us: we pass your request on to it and help it put the record right. We cannot rewrite another organisation’s record, such as a credit bureau’s; where the entry came from a registered credit bureau, we tell you which bureau, so you can use its own correction process. Where the entry is in the published sanctions and money-laundering watchlist data we keep copies of, we answer you ourselves: we record that the entry is disputed, refer it to the source, and tell you how to reach that organisation’s own correction process. Where the law requires us to restrict processing while accuracy is contested, we will do so, and we will tell you before any restriction is lifted.
• You are not satisfied with our answer. You may complain to the Information Regulator (South Africa). Its website is inforegulator.org.za.

Questions people ask us

Who to contact

The business that asked you

First, and for anything about why you were verified or what happened as a result. It will get you an answer faster than we can, because the answer is its.

Veriflow

support@veriflow.co.za
+27 83 209 0827
51 Ingersol Road, Lynnwood Glen, Pretoria, 0081

Our Information Officer

For anything about your personal information itself: what we hold, correcting it, deleting it. Email support@veriflow.co.za marked for their attention, or use the PAIA manual for a formal records request.

The Information Regulator

If you are not satisfied with how we or the business handled it. inforegulator.org.za

Last updated 30 September 2026.