Privacy
What we keep, and what we do with it.
CyberStanding is operated by Cyber Assurance Group, Inc. This page says what information the registry holds about a credential holder, why it holds it, who can see it, and how to reach us. Effective 10 September 2026. Voiceprint policy added 22 October 2026.
What we collect
When you enroll we ask for your name, your email address and, if you choose to receive your credential by text message, your mobile number. If you give the registry permission to read one of your systems, we record what that reading found and when it was taken. If you present your credential to someone, we record that it was presented. If you or a person you name sets up a voice check, a voiceprint is made, as described under Voiceprints.
Why we collect it
Your name and email address identify your record and let us send you your credential. Your mobile number is used only to send the text messages you asked for. Readings are the substance of the credential itself: they are what a person verifying it sees.
Who can see it
Your credential is visible to the people you present it to and to anyone you give the verification address to. Nobody else. Your contact details are never published on the credential.
The registry produces group statistics that describe many organizations together. Those statistics never identify you or your organization, and no reading can be traced back to you from them.
Text messages
If you opt in to text messages, we send you the link to your credential and, from time to time, a notice that a reading on your record has changed. We do not send marketing by text.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information may be shared with subcontractors who help us deliver the service, such as the messaging provider that carries the texts. All other categories of use exclude text messaging originator opt-in data and consent; that information will not be shared with any third party.
You can stop at any time by replying STOP to any message. Reply HELP for help. Message frequency varies. Message and data rates may apply. The full terms are on the terms page.
Selling your information
We do not sell it. We do not rent it. We do not trade it.
How long we keep it
Readings are written once and never edited, because that is what makes the record trustworthy. Your contact details are kept for as long as you hold a credential. You can ask us to close your record at any time, and we will stop sending to you and remove your contact details from it.
Voiceprints: retention and destruction policy
This is our public policy for biometric data. It applies to every voiceprint made for a Credential.
What we collect. Some steps ask a person to read a short number code aloud: approving a payment change, signing the records of a procedure, declaring an incident. When a person sets up their voice check, they read three codes, and our voice verification provider, VSFT Holdings, Inc. (ValidSoft), creates a voiceprint from those recordings. A voiceprint is a mathematical model of the person's voice. It is a biometric identifier. We collect it only after the person has been told in writing what is collected, why and for how long, and has given a written release: the holder in the Consent, every other person in their own voice release.
Why. One purpose only: at each voice check, to confirm that the speaker is a live person and is the person who set up the voice check. We use voiceprints for nothing else.
Where it is kept. ValidSoft holds the voiceprint for us. ValidSoft keeps each recording for up to two weeks for troubleshooting, then deletes it. We keep a reference to the voiceprint, the result of each check and a fingerprint (a one-way hash) of each recording. We do not keep recordings or voiceprints ourselves.
How long. We keep a voiceprint only while its purpose lasts. We permanently destroy it when that purpose is satisfied, or within three years of the person's last interaction with us, whichever comes first. The purpose is satisfied when:
- the person asks us to destroy it or withdraws their release;
- the person is removed from the Credential's People list; or
- the Credential ends.
If none of these happens, a voiceprint is destroyed three years after the person's last voice check.
How it is destroyed. Within 30 days of the event, we instruct ValidSoft to delete the voiceprint, and ValidSoft deletes it permanently. We then remove our reference to it. Recordings are deleted by ValidSoft within two weeks of being made. The results of past checks and their fingerprints stay in the Credential's sealed record. They are not biometric identifiers, and a voice cannot be rebuilt from them.
Never sold. We do not sell, lease, trade or otherwise profit from voiceprints or recordings. They are never part of the group statistics.
Who receives it. ValidSoft, which processes voiceprints only for us. We disclose voiceprints or recordings to no one else, except with the person's consent, to complete a step the person asked for, or where the law requires it.
How it is protected. We store, transmit and protect voiceprints with at least the same care we give our other confidential information, and require the same of ValidSoft.
Your request. To have a voiceprint destroyed, email registry@mycyberstanding.com.
The browser extension
Cyber Credential Setup, the browser extension for setting up your credential, has its own privacy page: what it reads, and where it stays.
How to reach us
Email registry@mycyberstanding.com. We answer every message.