Global compliance
Built to clear procurement in the EU, UK and United States
FlagFake is designed for regulated buyers. This page sets out the contractual, residency and governance controls we offer, and is maintained by FlagFake — it is not an independent audit, certification or legal advice.
Regional coverage
Verification touches identity documents, payroll records and financial evidence. Each region treats that data differently, so the controls follow the region.
European Union
EU data residency option, a signed Data Processing Agreement with defined processing purposes, Standard Contractual Clauses where data leaves the EEA, and documented sub-processor disclosure.
United Kingdom
UK Addendum to the SCCs, UK/EU hosting, records of processing support and DSAR handling within statutory deadlines.
United States
US region hosting, service-provider contract terms, consumer rights request support and clear limits so verification output is never used as a consumer report or adverse-action basis on its own.
Other jurisdictions
Regional terms and hosting are agreed case by case during procurement. Tell us your jurisdictions and we confirm what we can support in writing.
Controls your legal and security teams will ask about
The questions that come up in every corporate review, answered up front.
Residency
Choose where files live
Contracts
DPA, SCCs & UK Addendum
Retention
Configurable deletion windows
Access
SSO, RBAC and audit trail
AI transparency
Explainable, human-reviewable output
Model use
No training on your uploads
Vendor due diligence pack
Available on request
- Security questionnaire and vendor assessment responses
- Data Processing Agreement, SCCs and UK Addendum
- Sub-processor list with change notification
- Data flow and retention documentation
- Penetration test summary and remediation status (under NDA)
- Business continuity, incident response and breach notification process
- Insurance certificates and supplier onboarding forms
How we state our position
We only claim what we can evidence. Where a certification is in progress rather than held, we say so in writing. Where a control is your responsibility — lawful basis for verifying a third party's document, who you grant access to, the retention window you configure — we say that too.
Automated verification results are probabilistic forensic assessments, not legal determinations. They are intended to support a trained human reviewer, never to replace one in decisions that affect a person's employment, credit or legal standing.
Data subject and consumer rights
Access & portability
DSAR support
Erasure
Right to deletion
Objection