Who is responsible for the management, processing, storing and protection of beneficiary personal data and biometric register?

IrisGuard does not register beneficiaries and as such, does not collect, access, store or process any personal data or biometric records. For further information on our data management process please refer to our Privacy Notice.

Any personal data and records held on a biometric register collected by our clients/partners will be solely managed by them and stored on their own servers. They are responsible for the safe and secure processing, protection and access to the data, as well as regular monitoring, risk assessments and compliance with current and relevant data regulations.

IrisGuard does not store and does not have access to any biometric or demographic records, which are held and managed exclusively by the organisation that owns the information.

Who is responsible for the enrolment/registration of a persons’ biometric records and obtaining appropriate consent?

Collection of biometrics records in a non-refugee context will sit with the trust authority body. This could be a financial organisation or a Government agency, depending on the nature and purpose of the project.

The organisation responsible for the registration, consent and collection of biometric records carries the responsibility for ensuring that appropriate consent for both enrolment and storage of the data has been obtained, in line with the relevant data compliance regulations.

How foolproof is our technology?

IrisGuard is a well established leader in iris recognition with more than 20 years of experience in the sector. We hold multiple breakthrough patents to ensure unmatched quality and countermeasures. All IrisGuard imagers are designed with built-in industry-leading and patented ‘liveness-detection’, which ensures the presence of a live image as opposed to a still picture or a live video feed.

Our unique technology components are also designed to automatically detect the presence of contact lenses in the subject’s eyes and thwart their use affirmatively. Furthermore, IrisGuard’s patented measures include automatic and rapid detection of the presence of pupil dilation substances (such as eye drops), designed to evade detection.

All these unique and world-leading measures do not interfere with the rapid capture process of 3 seconds for both eyes, even while the subject is wearing glasses.

What security measures are in place for both hardware and software?

All IrisGuard’s EyeCloud® products in its fixable, portable and embedded range, are protected to the highest level and are certified to ISO9001:2015 and ISO 27001 standards.

Our APIs include further checks to determine if any unauthorised tampering or changes have occurred to the phone, such as rooting. This automatically disables the APIs and therefore ensures protection of data.

EyeCloud® platform access can be granularly enforced on many parameters including; device IMEI, MSISDN, hardware serial number, IP address, date and time as well as a built-in radius-based geo-fence mechanism and more.

EyeCloud® packets are protected with an end-to-end encryption scheme, which uses the latest industry-standard cryptographic algorithms including PKI, AES256 and SHA512. The use of hardware-based keys, Android Key Store random key generation and session keys ensures end-to-end encryption against all known attacks.

Our EyePay® Phone has full compliance to PAD (Presentation Attack Detection) ISO 30107-3 Level 1 testing, performed independently by iBeta labs in the USA. iBeta is a leading NIST NVLAP-approved biometric register test lab and the first FIDO alliance accredited test lab for biometric testing. IrisGuard is one of only two companies globally to achieve this level of PAD performance for iris scanning.

Can biometric recognition technology be used for other projects, outside of the refugee context?

Yes. We have developed biometric registration solutions directly addressing the needs of all our clients which are fit for purpose, streamline their operations and provide transparency. Designed for seamless integration into existing databases or payment systems, we deliver a true end-to-end iris recognition-based solution that delivers cost-effective digital and financial inclusion to the world’s 1.7 billion plus unbanked.

Biometric machine registration provides authentication and authorisation of cash transactions, pensions, social welfare payments, money remittances and medical services. It also links with mobile wallets via our EyePay® Phone or POS devices. It requires one-time enrolment only and is scalable, depending on the size of project, with no minimum value or frequency required.

What policies does IrisGuard have in place around ethical use of technology and marginalised people?

IrisGuard is a GDPR compliant company. We strictly adhere to GDPR in all our operations even though we do not collect, manage, process or store any personal data nor biometric registers of refugees or beneficiaries on any of our company servers.