AI & Machine Learning Statement

Data Use. ID123 does not use Personal Data submitted by our institutional customers or their end users — including photos, identity documents, and other cardholder information — to train, fine-tune, evaluate, or develop artificial intelligence or machine learning models, unless our customer requests such use and provides its prior written consent. Where such consent is given, only that customer’s own data is used, and solely to provide the model to that customer. ID123 sends Personal Data to a third-party AI or machine learning service only if that service is listed on our Sub-processors page and does not use our customers’ Personal Data to train or improve its models, with any retention limited to what is necessary to perform the requested function and to meet that service’s own security, abuse-monitoring and legal obligations. Some providers derive de-identified, aggregated statistics that cannot reasonably be used to single out, infer information about, or be linked to any individual, and use them to improve their own services. Where they do, we say so on the Sub-processors page. Our binding commitments to customers are set out in our Data Processing Addendum, which controls if anything on this page differs.

Governance. Deployment of any AI-enabled feature requires review and sign-off through ID123’s existing Change Approval Board process before reaching production, with the Head of AI Governance serving as the accountable reviewer for that assessment.

Secure Development. AI-enabled components of the Service are developed under an extension of ID123’s Secure Software Development Life Cycle, incorporating risk assessment aligned with the NIST AI Risk Management Framework, security testing informed by the OWASP Top 10 for Large Language Model Applications, and adversarial testing prior to deployment.

Safeguards. ID123 relies on established, reputable AI providers rather than developing foundation models internally. AI components are scoped to the minimum data and actions necessary to perform their function, and inputs are limited to the minimum context required for that task to reduce exposure to manipulation such as prompt injection. Harmful outputs are mitigated by relying on established providers’ built-in content-safety infrastructure rather than unfiltered model access. Any AI-generated content directed at a customer or end user is reviewed by ID123 staff before it is sent; AI is not used to generate or send communications to customers or end users without human review.

Content Integrity. ID123 does not use AI to generate synthetic photographs of a person’s face. Where a customer requests an avatar or similar AI-generated image feature, any resulting AI-generated image will be watermarked to indicate it is AI-generated. Editing of a photo submitted by an end user — such as background removal — preserves the substance of the original photo and does not require a watermark.

Reporting Concerns. Questions, safety concerns, or reports related to AI features can be sent to security@id123.io, the same channel used for our Security Vulnerability Disclosure Policy.