Necessity
Prove verification is necessary and proportionate, and document a route without identity-document photography.
Milestone 5 · open for validation
Prepare the safeguards without collecting a single document.
KIIRAAY is documenting what it would need to prove before considering identity verification. The real module does not exist in this release.
0images or documents accepted
0national identifiers stored
6control families
7 daysfictional-scenario lifetime
Activation barriers
No shortcut from an idea to high-risk processing.
Every barrier needs dated evidence and an accountable owner. No choice in this lab can open collection.
Law & CDP
Obtain counsel review, complete the applicable formality, and name accountable owners before any processing.
Minimization
Approve the purpose and strictly necessary fields, with a permanent ban on facial recognition.
Segregated security
Test separate storage, encryption, permissions, logging, automatic deletion, and incident response.
Review & appeal
Train reviewers, use coded reasons, and offer correction, an alternative, appeal, and data-rights handling.
External audit
Have qualified third parties review the architecture, vendors, transfers, retention, and security evidence.
MySQL lab · synthetic governance only
Validate the workflow before any identity verification.
This lab tests controls and appeal paths using fixed choices. It verifies nobody and receives no document.
0 documents received0 OCR0 biometric data0 people verified
The result documents missing work. It authorizes no photography, OCR, national-ID storage, or biometrics.
Non-negotiable boundaries
A membership card is not a government identity document.
A future KIIRAAY credential must use a random internal identifier, contain no national-ID number, and remain visually distinct from a state document.
The membership path must remain operable without national-card photography.
No facial recognition, portrait-to-selfie matching, template, liveness, or emotion analysis.
No OCR, identity, or international-transfer provider has been selected or authorized.
The lab produces governance gates, never an identity confirmation or refusal.
Working references: Law No. 2008-12 on personal data ↗ and the formalities published by the CDP ↗. Cataloging them is neither legal advice nor authorization.