Customer-Managed Storage (BYOS)

• An S3-compatible storage bucket with a private access policy
• IAM credentials (access key + secret key) with PutObject, GetObject, and DeleteObject permissions
• AgeEvidence account on Scale or Business plan (or Launch with the BYOS add-on)

Provide your S3 credentials via the client dashboard or API. The following fields are required:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::my-verification-media/*"
    }
  ]
}

No ListBucket or bucket-level permissions required. AgeEvidence only operates on individual objects within the paths it creates.

Objects are written using a deterministic path:

{level}/{external_id}/{timestamp}-{file_type}.{ext}

full-kyc/user_abc123/1705500000000-continuous.webm
full-kyc/user_abc123/1705500000000-id-front.jpg
full-kyc/user_abc123/1705500000000-id-back.jpg
age-verification/user_xyz789/1705500000000-face-frame.jpg

AgeEvidence recommends enabling server-side encryption on your bucket:

• SSE-S3 — automatic encryption with provider-managed keys (simplest setup)
• SSE-KMS — encryption with your own KMS key for additional access control

AgeEvidence does not manage encryption keys. Encryption is handled entirely by your storage provider.

• Upload failures are retried up to 3 times with exponential backoff (1s, 2s, 4s)
• If all retries fail, the verification session fails and the user can restart
• No media is stored on AgeEvidence infrastructure as a fallback
• Failed uploads are logged in the verification audit trail with error details

Even with BYOS enabled, AgeEvidence retains the following in its database:

• Verification record (ID, status, timestamps, verification level)
• Admin decisions (approve/reject/resubmit with reasons and reviewer ID)
• Face descriptors (for face matching during review)
• Fraud signals (anti-spoof scores, liveness results)
• Estimated age (for age_only verifications)
• Performer records (for full_kyc — legal name, DOB, 2257 data)
• Access audit trail (who accessed what, when, from where)

Media file references (S3 paths) are stored so AgeEvidence can generate signed URLs from your bucket during admin review.

Use a separate bucket or path prefix for testing. The sandbox environment supports BYOS configuration independently from production.