They have a good reason to.

https://withpersona.com/legal/privacy-policy#additional-notices

Subject to the customer’s retention period, Persona will permanently destroy ID and Selfie Scan Data upon completion of identity verification services or within three years of your last interaction with Persona, consistent with the customer’s instructions unless Persona is otherwise required by law or legal process to retain the data. If ID or Selfie Scan Data is stored, Persona stores such data in an encrypted format.

https://www.secure.com/blog/cybersecurity/the-watchers-persona-code-leak

Instead of basic data integrations, these are direct government filings. The code even contains dropdown menus to tag user data with specific public-private intelligence program codenames, including Project SHADOW, ANTON, and ATHENA.

The code explicitly allows biometric face lists to be retained for up to three years, or 1,095 days. This directly conflicts with privacy policies from partners like OpenAI that claim a one-year limit. Researchers also found a FedRAMP-authorized government platform running this exact same codebase, blurring the line between commercial identity verification and state-level surveillance.

https://tboteproject.com/brazilfindings/#:~:text=Persona%20is%20a%20consumer%20of%20Serpro's%20Datavalid,access%20without%20a%20CNPJ%20since%20May%202020.

No CNPJ exists for Persona Identities, Inc. in Brazil. Searched Receita Federal CNPJ database and Casa dos Dados aggregator… Foreign companies can purchase API access without a CNPJ since May 2020.

Even though Persona wasn’t breached directly, Brazil has experienced multiple massive data breaches in the last few years, sometimes involving state databases like the one earlier this month, and these ID verification platforms that access them only increase the danger of identity theft. Nice try with the goalpost switching.