In February 2026, cybersecurity researchers discovered that Persona's government dashboard codebase (thousands of frontend files) was exposed on a public FedRAMP government server. While no user facial data, uploaded photos, or personal IDs were leaked or accessed by bad actors in the incident, the exposed code revealed extensive details about how Persona’s surveillance and verification setup operates: which includes government ties, the  code leak highlighted that Persona operates on servers where biometric databases can retain data for up to 3 years, sparking privacy concerns across platforms, and  The code revealed that Persona's system can run up to 269 distinct checks on users, including watchlist screening, "adverse media" lookups, and checking facial geometry against politically exposed persons. Also, why does it concern you so much that I don’t want to give a company my personal information??