The First Rule of Zero-Trust KYC Club: You Do Not Transmit Customers’ Personal Data

Much of today’s KYC industry still relies on a broken trust model. Identity documents, face images, personal identifiers, and other sensitive information freely move between devices, networks, cloud platforms, verification vendors, subcontractors, and human operators – with every handoff adding another party or infrastructure layer that businesses and users are expected to trust. This model ignores a simple truth captured by the old saying: “Three may keep a secret, if two of them are dead.” 

To break this cycle of unnecessary trust and data exposure, OCR Studio created the Zero-Trust KYC Manifesto, which establishes four non-negotiable principles for rebuilding identity verification. The first of them reads:

---

7.1. Identity Data Must Remain at the Point of Presentation

7.1.1. In Zero-Trust KYC, all sensitive identity data used in the KYC process must remain at the point of presentation: identity document images, selfies, personal identifiers, document details, machine-readable data, biometric features, etc. 

7.1.2. On-premises deployment is not the goal. It is the minimum acceptable infrastructure tier for cases where server-side processing is unavoidable. It keeps identity data inside the business perimeter, but it does not remove the transfer itself. Zero-Trust KYC must go further: from cloud-first to on-premise, and to on-device or in-browser processing whenever possible.

---

In today’s blog post, we take a closer look at this principle and explain what it means in practice.

What Keeping Identity Data at the Point of Presentation Entails

The first part of the principle is straightforward: identity data should remain in the environment where the user provides it. In other words, sensitive information should not be transferred merely because external processing is the simplest way to scan and authenticate documents during onboarding.

The principle applies regardless of how the customer interacts with the business:

• If an identity document is presented at a bank branch, hotel desk, border checkpoint, telecom store, or other point of service, the organization should not send the ID image to an external platform when the processing can be completed locally;
• If a user scans an identity document in a mobile application during KYC, the raw image should not leave that application for data extraction or authenticity checks;
• If a customer completes a selfie-to-ID check, age verification, or any other KYC procedure in a browser, neither the document image nor the face image should be sent outside that browser.

Some later KYC stages may inherently require controlled communication with authoritative or regularly updated data sources. Thus, the principle does not prohibit unavoidable data use – it requires every transfer to be justified by necessity rather than by the convenience of an external architecture.

Why Even On-Premises Deployment Is Not Enough

On-premises deployment is significantly safer than sending identity documents to a cloud OCR provider or other external party. It keeps processing within the organization’s infrastructure, removes many unnecessary vendors from the data route, and gives the business greater control over customer information.

However, on-premises processing does not eliminate data transfer itself. The document still has to travel from the point of presentation to a server (an internal one this time), creating a device-to-server route and a centralized processing environment that must be trusted and protected. For this reason, on-premises deployment is the minimum acceptable infrastructure tier when server-side processing is genuinely unavoidable – not the final objective of Zero-Trust KYC. 

The table below compares cloud-first, on-premises, and on-device ID scanning architectures, showing why only the last of these fully aligns with the first principle of the Manifesto.

Comparison Criterion	Cloud-First ID OCR	On-Premises ID OCR	On-Device ID OCR
No third-party access to identity data	✗ Provider personnel or subprocessors may form part of the processing chain	✓ External processor access is removed	✓ No third-party receives ID images or the extracted data
No external transfer of raw ID images	✗ External transmission is required	✓ No external data transfer, but transmission to an internal server is still required	✓ No transfer is required for ID scanning
No exposure to vendor-side breaches	✗ Identity data may be affected by a provider incident	✓ Exposure is reduced, but centralized server risk remains	✓ No exposure as ID scanning is performed client-side
ID scanning at the point of presentation	✗ Performed within external vendor infrastructure	✗ Performed on the organization’s internal server	✓ Happens at the point of presentation – in mobile apps or browsers thanks to the Web-Native OCR technology
Consistent ID scanning availability	✗ May be disrupted by a vendor outage or server delay	✗ Depends on the availability and capacity of internal servers	✓ Delivers consistent performance without depending on network connectivity or server availability
Connectivity independence	✗ Stable internet access is generally required	✗ Access to the internal server or network is required	✓ Passport scanning and other ID data extraction are performed fully offline
Full alignment with Zero-Trust KYC first principle	✗ Adds external trust by design	✗ Reduces trust but does not eliminate the transfer	✓ Removes unnecessary trust from the ID scanning layer

On-premises deployment is a major improvement over cloud-first ID OCR because it brings processing inside the business perimeter. However, only on-device ID scanning can eliminate the transfer of document images, keeping raw identity data exactly where the user presents it.

What Happens When Identity Data Leaves the Point of Presentation

Once identity data leaves the environment where the customer presents it, the organization has to trust every system, vendor, and person that can access it afterward. The Coinbase incident demonstrates how dangerous this trust can become even when attackers do not technically breach the company’s infrastructure.

In May 2025, international crypto trading platform Coinbase disclosed that criminals had bribed and recruited overseas support agents to obtain customer information. The agents abused their legitimate access to internal support systems and passed the following data to the attackers:

• Government-issued ID images, including passports and driver’s licenses;
• Names and addresses; 
• Phone numbers and email addresses;
• Dates of birth;
• Account balances and transaction histories.

The exposed identity and account information gave criminals valuable material for targeted social engineering. This happened because external support personnel had been trusted with access to data that could expose customers to fraud and identity theft long after onboarding was complete.

The First Principle of Zero-Trust KYC in Practice

The current level of AI development allows the entire ID scanning layer to operate locally on a smartphone, tablet, laptop, desktop computer, or kiosk – without sending raw document images to clouds, remote recognition servers, or crowdsourcing platforms.

OCR Studio built its solutions around this architecture from the beginning. Its proprietary ultra-lightweight, highly optimized neural networks make it possible to perform computationally demanding scanning and ID verification tasks even on low-power devices, while the WebAssembly technology enables near-instant ID data extraction directly inside popular browsers.

OCR Studio’s ID card scanner supports identity documents issued across more than 240 countries and territories in over 100 languages. The solution recognizes even complex writing systems, including Arabic, CJKV, and other scripts without applying to any external services.

You can test this on-device architecture yourself by downloading the OCR Studio Demo Application or opening the Web Demo. Once the Web Demo has loaded, switch your device to airplane mode and see how document scanning continues to work quickly and accurately as OCR is performed in local device memory rather than on a remote server.

ID Scanning at the Point of Presentation Must Become the New KYC Standard

Zero-Trust KYC is the only viable model for the digital economy of today and tomorrow, and its first principle cannot be treated as an optional privacy feature. Without ID scanning at the presentation point, organizations cannot remove one of the most dangerous trust layers – the trust in third-party service providers they do not control.

This is a signal for businesses to make client-side ID scanning a mandatory procurement requirement, for KYC providers – to build local processing into the foundation of their products rather than offer it as a limited alternative, and for regulators – to consider unnecessary identity data transfers as an avoidable architectural risk rather than an industry default.

The reason for all this is simple and will remain true regardless of how security standards evolve: the safest data transfer is the one that never takes place.

Learn more about OCR Studio Zero-Trust solutions

FAQ

1. What does “Identity data must remain at the point of presentation” principle mean?

This is the first principle of the Zero-Trust KYC Manifesto, which means that identity document images, extracted fields, selfies, MRZ data, and other sensitive information should be processed directly in the environment where the customer provides them whenever technically possible. During an in-person workflow, identity data should not be transmitted to external service providers. A mobile application should perform ID scanning on the smartphone, while a web onboarding flow should happen locally inside the browser.

2. What is the difference between on-premises and on-device KYC?

On-premises KYC sends identity data to servers located within the organization’s own infrastructure. Although this removes the external cloud provider, document images and other sensitive data must still travel from the capture device to an internal server. On-device KYC performs ID scanning directly on the smartphone, tablet, laptop, or in the browser where it is presented. This eliminates the device-to-server transfer and keeps identity data at the point of presentation.

3. Can document authenticity checks run fully on-device?

Yes. OCR Studio’s solutions can perform a broad range of document authenticity checks locally, including data cross-validation across the VIZ, MRZ, barcode, and NFC chip, deepfake and morphing detection, photocopy and screen-recapture detection, collage and field-substitution detection, date-of-birth manipulation detection, and checks for inconsistencies in document layout, portraits, text fields, and machine-readable data.

4. Can on-device ID scanning work without an internet connection?

Yes. Because the ID scanning runs in local device memory, client-side OCR Studio solutions can operate without a network connection. This also makes it suitable for branches, border checkpoints, field operations, kiosks, and other environments where connectivity may be unavailable or unreliable.

5. How can a business test Zero-Trust client-side ID scanning?

A business can open the OCR Studio Web Demo in a desktop or mobile browser and scan an identity document without installing any applications or plugins. After the demo has loaded, the user can disable the internet connection and see that ID scanning continues locally without sending the document image to an external server.