PENTESTY · EDITORIAL ANALYSIS · · 4 min read
IDScan: does your integration need to send the whole document?
Confirm which data supports the business decision and where images and extra fields are transmitted. A verification result and an identity copy serve different purposes.
By Pentesty
The official update changes the news context
In its notice updated September 29, 2026, IDScan reports unauthorized access to part of its cloud between April 4 and September 2, limited to VeriScan in the investigation conducted to date. Potentially involved data varies with each customer's usage. The notice gives no official total of 150 million documents. On September 21, Canada's OPC regulator opened an investigation into safeguards and notifications, without publishing a compliance finding.
Start with the decision the business needs to make
Before discussing API fields, write down the stage's purpose: checking a registration requirement, validating submitted information or escalating an exception for review. Identify the decision owner and applicable requirements with the appropriate teams. Minimizing data does not mean disabling necessary controls or assuming one configuration suits every sector.
For each purpose, connect the required information, receiving service and result that must come back. Question extra fields inherited from an integration example. The third-party data access analysis helps distinguish an authorized query from the actual reach its operation provides.
Distinguish images, extracted fields and verification results
A document image, a collection of fields and a verification response are different objects in the design. Assess which object each participant needs to receive. A team tracking registration progress may need the request's status, while an authorized review function needs a different information set. Make that decision explicit and verifiable.
Map the path from the capture interface to the provider and internal services. Include responses, integration notifications and diagnostic records. Mark each transformation and who approves its recipient. This map is a hypothesis about your implementation, rather than a statement about the IDScan incident's vector or configuration.
Accept the change based on its effect on the workflow
If a field is removed, repeat the legitimate operation and agreed error cases. Confirm that the team can decide on registration and handle exceptions without reintroducing the complete image through an informal channel. Useful evidence connects purpose, configuration, message sent and observed response, with the test environment's limits.
Provider allegation assessment complements operational contact: request specific answers about your integration's data and responsibilities. Record questions that depend on the provider and who follows them to resolution. The exercise demonstrates the selected current workflow; it does not retrospectively measure an external database's contents or prove deletion of old copies.
Frequently asked questions
Did IDScan officially confirm 150 million documents?
The official notice consulted does not give that total. The attributed confirmation of platform access and numbers circulating in reporting are different evidence and should remain separate.
Has the Canadian investigation already found a violation?
The September 21 announcement opens an investigation into safeguards and notifications. It does not publish a final compliance or responsibility decision.
Does minimization mean abandoning identity verification?
The proposal is to justify and test each item transmitted for an approved purpose. Identification requirements and specific obligations need assessment by the appropriate owners before changing the process.
How can testing avoid using a real identity document?
Use fictional files and synthetic fields in an authorized or simulated environment. Observe messages and records within scope, confirm the legitimate result and document dependencies on the provider.
Sources and references
Original Pentesty analysis, published October 16, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.