A KYC record is two things: the verified profile your IDV provider returned, and the passport scan and selfie behind it. Databunker Pro keeps both under one encrypted customer record — with one access policy, one retention clock and one audit trail across both.
The Challenge
Onboarding leaves you holding the most sensitive record you will ever store: a verified name, national ID and date of birth, plus the documents that prove them. It lives in a users table and a bucket nobody reviews — and years later a regulator asks who looked at it.The Solution — Four Capabilities
1. Prove what you verified, and when
Record versioning keeps every profile state with an integrity hash, reconstructable years later.
2. Only the fraud team opens the ID scan
CRBAC scopes access per field and per document; support sees a masked profile, not the passport.
3. A retention clock on every record
slidingtime gives a rolling window, finaltime an absolute cutoff — set per customer.
4. Bulk reads are default-deny
Nobody dumps the KYC book with a stolen token: bulk retrieval needs a separate 60-second unlock.
How It Works
Store the verified profile, attach the documents to that customer, read both back by token.# verified profile in, token out
POST /v2/UserCreate {"profile":{"name":"…","dob":"…","natid":"…"}}
→ { "status": "ok", "token": "cba3da40-…" }
# the passport attaches to the customer, not to a bucket path
POST /v2/FileCreate {"mode":"token","identity":"cba3da40-…","tags":["passport","kyc"]}Your IDV provider still does the verification — Databunker Pro stores and governs what it returns.
The Payoff
- Hand a regulator one access trail for the profile and the documents.
- Match a transliterated or misspelled name without decrypting.
- Erase a customer and their documents in a single call.
- An injection returns tokens, not customer identities.
Honest limits: versioning is enabled in configuration, not on by default. AML retention can override an erasure request — the vault enforces the window you set, not the one you owe.