Biometric data is the most sensitive data an institution will ever hold.
A password that leaks can be changed. A fingerprint that leaks cannot. That asymmetry is the whole reason biometric systems deserve a higher standard of care than the systems around them, and it is the reason this page exists rather than a line in a footer.
How the data is held
Templates, not images
Where the deployment permits, Biolog stores mathematical templates derived from the biometric sample rather than the raw image. A template cannot be reversed into a usable fingerprint.
Encryption
Data encrypted in transit and at rest, to standards confirmed in the data handling statement issued for your deployment.
Access control
Role-based, least-privilege, with every access to an identity record logged and attributable.
Segregation
Each institution’s register is logically separated from every other institution’s.
Residency
Data can be held within Nigeria where policy or regulation requires it.
The institution’s obligations, and how Biolog supports them
Compliance is a shared responsibility. We provide the mechanisms; the institution holds the lawful basis and the controller obligations.
| Obligation | What Biolog provides |
|---|---|
| Lawful basis and notice | Configurable consent capture and notice text at the point of enrolment, so the data subject is told what is being collected and why, at the moment it happens. |
| Purpose limitation | Data captured for examination verification is not repurposed. Configuration constrains what each verification point can see. |
| Retention | Retention periods are configurable, with automated deletion at expiry. A graduated student’s biometric data does not sit in the register indefinitely by default. |
| Subject rights | Access, correction and, where applicable, erasure requests handled through the console with a full record of the request and its handling. |
| Breach notification | Incident response and notification procedures aligned to NDPA 2023 timelines. |
Certifications and assessments
We publish what we hold and nothing else. Where a framework is in progress rather than held, we say so in the data handling statement rather than implying it here. An unverifiable certification claim on a security page is worse than no security page at all.
The current position, in writing, is issued with the data handling statement for your deployment.
Data handling statement
The deployment-specific document covering template storage, encryption standards, tenancy, residency, retention schedules and incident response.
See Biolog running against your own process.
A working session with our team, not a slide deck. Bring your enrolment volumes, your verification points and your awkward edge cases. We will show you how Biolog handles them.