What local and cloud KYC are from the perspective of biometrics storage
The choice between local and cloud hosting of a KYC system determines not only the technical aspects of working with biometrics but the entire model of risk management, control and responsibility. In Russia, since 2024, this choice has become even more significant: even when cloud storage is used, the main responsibility for protecting biometric data lies with the personal data operator, not the provider.
Local (on-premise) and cloud hosting of KYC represent two fundamentally different architectures for storing and processing biometric data.
A method of working with software on the company’s own servers, where the system is fully maintained by an in-house team of IT specialists.
The company delegates the storage and processing of biometrics to an external provider while retaining legal responsibility for data security.
The critical difference lies in the physical location of the infrastructure and the degree of control. With local deployment, biometric templates, face vectors, source images and associated metadata are located within the organization’s physical perimeter. In the cloud model, this data is placed in the provider’s data centers, often geographically distributed to ensure fault tolerance.
Local (on-premise) KYC: where biometric data is located and who controls it
With local deployment of a KYC system, the biometric data is located directly in the corporate data center or the company’s server room. This means full physical control over the storage servers, the computing power for processing biometrics, and the network infrastructure through which the data is transmitted.
The company does not depend on the software developer’s hardware and team, and with a well-thought-out placement of internal servers, one can achieve even higher performance than in cloud storage. Biometric templates are stored in databases deployed on the company’s own servers, which makes it possible to apply any required encryption and access control methods without restrictions from third parties.
Control over biometric data with on-premise deployment is carried out entirely by the organization itself through its IT department or information security department. Database administrators manage the biometrics repositories, security engineers configure the protection and monitoring systems, and the support team ensures the smooth operation of the entire infrastructure.
A key feature of local hosting is the ability to operate in an isolated environment. If a company has its own server, only its in-house employees will be able to open files and access the biometrics. This is critical for organizations with heightened confidentiality requirements or those operating in closed segments of critical information infrastructure.
In the Russian context, local storage of biometrics is especially relevant for organizations that fall under Federal Law 572-FZ. Banks, fintech and other market players are not entitled to create their own biometric databases — at most, short-term storage of data at the moment of the check is allowed. However, for internal access control systems (ACS) and other corporate tasks, local hosting remains permissible provided the requirements of the law are met.
Cloud KYC: the biometrics storage model and the division of responsibility with the provider
The cloud KYC model involves placing the entire biometrics processing and storage infrastructure in the data centers of an external provider. The biometric data is physically located on the cloud operator’s servers, which may be geographically distributed to ensure reliability and access speed.
The cloud provider does not have access to the information systems hosted in the cloud, and therefore does not take on responsibility for the personal data — in the event of a leak, it is the operator who will answer to Roskomnadzor. This is a fundamental point: the provider supplies only the infrastructure with a certain level of protection, but the legal responsibility for the biometrics remains with the operator company.
When storing personal data, it must obtain FSB and FSTEC licenses and pass certification for compliance with information security requirements. This guarantees a basic level of infrastructure protection — the physical security of the data centers, backups, protection against DDoS attacks, and ensuring the availability of services.
Fulfills the duties of configuring the correct access policies for biometric data, application-level encryption, control of user actions, and compliance with the procedures for obtaining consent to process biometrics. The company needs to competently manage access within the organization and control security settings, including encryption, two-factor authentication and action logging.
Cloud KYC platforms in 2025 offer various hosting models. A public cloud provides maximum flexibility and scalability, making it possible to process millions of biometric checks without capital expenditure on infrastructure. A private cloud provides dedicated resources for a single organization, retaining the advantages of the cloud model with an increased level of isolation. A hybrid model makes it possible to store the most sensitive biometric data locally while performing computationally intensive operations in the cloud.
An important feature of cloud KYC is compliance with the geographic storage requirements. Data may be transferred abroad, but its initial recording, systematization, accumulation and storage must be performed on a server physically located in Russia. Modern cloud providers offer a choice of the data hosting region, which makes it possible to comply with the requirements of various jurisdictions.
The economic model of cloud KYC differs substantially from local deployment. Instead of large capital investments in hardware and licenses, the company pays for actual resource usage — the number of checks, the volume of stored biometric templates, the computing power for processing. This makes advanced biometric verification technologies accessible even to small companies and startups that cannot afford to build their own secure infrastructure.
Where biometrics is stored in KYC: the real data storage points
Biometric data in KYC systems never exists at a single storage point. The architecture of any solution — local or cloud — involves multiple repositories with different levels of access, retention periods and protection mechanisms. Understanding the real picture of data placement is critically important for assessing risks and meeting regulatory requirements.
During verification, biometric templates pass through dozens of systems: from the moment a face image or fingerprint is captured to the final archiving after the check is completed. Each point on this route creates a potential vulnerability and requires separate control.
The main biometrics repositories: production databases, archives, backups
| Category | Description |
|---|---|
| Production databases | Contain the active biometric templates of customers undergoing verification. In cloud solutions, these are distributed database clusters with replication between data centers to ensure fault tolerance. Biometric vectors are stored in encrypted form together with metadata: the time of creation, the type of feature extraction algorithm, the version of the neural network model. The retention period in production databases is usually from a few hours to 30-90 days depending on the business processes and regulatory requirements. |
| Archive repositories | Are intended for the long-term storage of biometrics in accordance with the requirements of AML legislation. In Russia, under Federal Law 115-FZ, identification data must be stored for 5 years after the relationship with the customer ends. Archives use cold storage with infrequent access: the data is compressed, deduplicated and placed on separate servers or in object storage such as S3. For local solutions, these may be tape libraries or dedicated NAS systems with WORM protection against modification. |
| Backups | Are created on the 3-2-1 principle: three copies of the data, on two different types of media, one copy offsite. In cloud KYC systems, backup is performed automatically by the cloud provider’s tools with geo-replication between regions. With local deployment, the organization ensures backups on its own, including taking copies to a remote data center or storage. Biometric data in backups is encrypted with separate keys that are rotated independently of the main systems. |
Temporary storage: upload buffers, processing queues, logs, test environments
| Category | Description |
|---|---|
| Upload buffers | Receive the source face images or document scans before they are processed. At the moment of upload, a file of 2-5 MB is temporarily saved in the file system or object storage. After the biometric template is extracted, the source image must be deleted, but in practice it often remains in CDN caches, temporary directories of application servers, and backups of the buffer zone for a period from a few hours to several days. |
| Processing queues | Contain verification tasks with attached biometric data. Cloud systems use managed queue services (AWS SQS, Azure Service Bus, Kafka), which save messages to disk to guarantee delivery. The message lifetime in a queue is usually limited to 14 days, but in case of processing failures the data may accumulate and be stored longer than planned. |
| System logs | Record all operations with biometrics: the time of access, the comparison result, the similarity score. In detailed debug-level logs, the biometric vectors themselves or base64 representations of images may be saved. Logs are rotated with a period of 7-30 days, but archive copies for incident investigation may be stored for years. In cloud solutions, logs are automatically collected into centralized monitoring systems, creating additional storage points for biometric traces. |
| Test and pre-production environments | Contain copies of production data for debugging and testing new versions. Despite de-identification requirements, real biometric templates often end up in test environments through database dumps or when reproducing production incidents. The level of protection of test environments is traditionally lower than production: simplified authentication, extended developer rights, no encryption of traffic between components. |
Storage geography and data jurisdiction for cloud and local KYC
With local hosting, the organization fully controls the physical location of the servers holding biometrics. The data is located in its own or a rented data center on the territory of the company’s country of registration. This guarantees compliance with the requirements for the localization of personal data (in Russia — Federal Law 152-FZ, Article 18.1) and rules out the risks of extraterritorial access by foreign states.
Cloud KYC providers place data in the data centers of global cloud platforms. The main storage regions are Frankfurt, Amsterdam, London for European clients; Virginia, Oregon for American ones; Singapore, Tokyo for Asian ones. Russian cloud KYC services use the data centers of Yandex Cloud, Cloud.ru, SberCloud on the territory of the Russian Federation. At the same time, metadata, logs and backups may be stored in other jurisdictions.
A cross-border transfer arises not only from the explicit movement of data between countries but also from technical access from abroad. If a KYC provider’s support team is located in India or Eastern Europe, the specialists gain remote access to the biometric data, which is qualified as a cross-border transfer under GDPR. The use of global CDNs to speed up image loading leads to the caching of biometric data on edge servers around the world.
Jurisdiction determines the applicable law and the possibility of compelled data disclosure. American cloud providers fall under the CLOUD Act, which obliges them to provide data to US authorities regardless of the country of storage. European providers, after the EU Court’s ruling in the Schrems II case, must provide additional safeguards when transferring data outside the EU. Chinese cloud platforms are subject to the PRC’s national security law, which grants the security services the right to access any data.
To minimize jurisdictional risks, the “data residency” model is applied — a strict restriction of the geography of storage and processing. Biometric data is processed only in a specific region without the possibility of replication or backup to other countries. This complicates the solution’s architecture and increases the cost, but provides legal certainty for regulated industries.
Requirements for storing biometrics in local and cloud KYC
The storage of biometric data in KYC systems is regulated by a set of legal acts and technical standards that differ for local and cloud infrastructure. Biometric personal data may be processed only with the written consent of the personal data subject, and the requirements for the protection and storage of such data were significantly tightened in 2025.
Regulatory requirements in the Russian Federation for biometric data (Federal Law 152-FZ, the Bank of Russia, the UBS)
Federal Law 152-FZ establishes the basic principles of working with biometrics. From June 1, 2025, the maximum fines for a personal data leak will be up to 15 million rubles and up to 3% of the company’s annual revenue. Special requirements apply to biometric data: all data of Russian users must be processed and stored exclusively on the territory of the Russian Federation. The transfer of biometrics to foreign servers, including the use of international cloud services without localization, is prohibited.
The Central Bank of the Russian Federation has developed special requirements for financial organizations working with biometrics as part of KYC procedures. Banks must protect their IT infrastructure and communication channels when collecting the population’s biometric data and remotely identifying customers in mobile and online banking. The regulator has issued methodological recommendations 4-MR detailing the information security requirements for working with the Unified Biometric System.
The Unified Biometric System serves as the central element of the biometric infrastructure in Russia. The bank receives only the comparison result — the percentage of similarity of the samples — without gaining access to users’ biometric data. This fundamentally changes the storage architecture: the biometric templates themselves are stored centrally in the UBS, while organizations work only with vectors and matching results. The UBS must be protected in accordance with Order No. 453 of the Ministry of Digital Development, which contains the rules for processing, hosting and updating biometrics.
It is prohibited to process, including collect and store, biometric personal data used for identification purposes, except for processing for placement in the Unified Biometric System. Organizations are obliged either to transfer the collected biometrics to the UBS within the established periods or to delete it if the subject refuses the transfer.
International requirements (GDPR and others) for the cross-border transfer of biometrics
The European GDPR regulation classifies biometric data as a special category of personal data requiring enhanced protection. Confidential personal data includes biometric and DNA data, for which stricter protection rules are provided. The processing of biometrics under GDPR is permitted only with the explicit consent of the subject or the presence of legal grounds specified in the regulation.
| Standard | Description |
|---|---|
| The GDPR standard | When transferring biometric data across borders, organizations must ensure an adequate level of protection in the recipient country. This means verifying the compliance of local laws with GDPR standards, concluding standard contractual clauses (SCC), or applying binding corporate rules (BCR). GDPR is aimed at giving citizens control over their own personal data, including the right to erasure, restriction of processing, and data portability. |
| The international standards ISO 17799 and ISO 15489 | Establish additional requirements for information security management and the documentation of biometrics processing procedures. The rules for protecting biometric personal data are also set out in the ISO 17799 and ISO 15489 standards. These standards define the procedures for auditing, access management, and the cryptographic protection of biometric templates. |
For international KYC platforms, it is critically important to take into account conflicts of jurisdictions. The Russian requirement to localize data may contradict GDPR obligations regarding cross-border transfer within the EU. The solution is a hybrid architecture: biometric templates are stored locally in accordance with national law, while metadata and verification results may be processed in international infrastructure.
Mandatory technical measures for protecting biometric data storage
The technical requirements for protecting biometrics include the mandatory use of cryptographic information protection tools. Cryptographic protection tools are recommended both for ensuring the information security of communication channels and for electronic signature tools. Each biometric sample must be signed with an enhanced qualified electronic signature indicating the operator that collected the data.
A multi-level security system is applied to protect biometric templates:
For the destruction of biometric personal data, information protection tools that have passed the conformity assessment procedure and have a function of automatically destroying information after a specified period are used. This ensures compliance with the data minimization principle and prevents the accumulation of excessive biometrics.
Organizational measures: access roles, DPIA, contracts with the KYC provider and the cloud
Organizational measures for protecting biometrics begin with conducting a data protection impact assessment (DPIA). This procedure is mandatory when implementing biometric technologies, both under GDPR requirements and Roskomnadzor recommendations. A DPIA must include an analysis of biometrics leak risks, an assessment of the necessity and proportionality of the processing, and a description of the measures to minimize risks.
The delimitation of access roles and authority is built on the principle of least privilege. Access to biometric data must be granted only to employees directly involved in the identification processes. All operations with biometrics are subject to mandatory logging, recording the time, the subject and the nature of the actions. Roskomnadzor recommends establishing the procedure and periods for storing video recordings and specifying the responsible persons who have access to the system.
The cloud KYC provider acts as a processor operating strictly on behalf of the operator, without the right to use the biometrics independently.
The cloud provider must confirm that the servers are located in Russian data centers holding the necessary FSTEC and FSB licenses.
The contract must provide for regular penetration tests and assessments of compliance with the ISO 27001/27018 standards.
Since May 30, 2025, fines for failure to notify are 30,000-50,000 rubles for officials and 100,000-300,000 rubles for legal entities.
The provider must guarantee the complete and irreversible deletion of all copies of biometric templates, including backups and logs.
The following requirements apply to the biometric personal data processing consent form: the document must be extremely specific and unambiguous and must contain the purposes of processing, the retention periods, and the procedure for withdrawing consent.
Particular attention is paid to staff training. Employees working with biometric systems must undergo regular training on information security and personal data protection. The training program includes legal aspects, technical protection measures, the procedure for responding to incidents and data subject requests.
The security of cloud KYC: key risks of storing biometrics
Cloud KYC platforms provide fast integration and scalability, but placing biometric data in the cloud creates specific security risks. Biometrics belongs to a special category of personal data — it is immutable and unrecoverable. If a password can be changed after compromise, then fingerprints or facial geometry cannot be changed. This makes protecting biometric data in cloud infrastructure a critically important task that requires an understanding of all potential threats.
Data centralization and the risk of mass leaks in cloud infrastructure
Cloud KYC systems concentrate the biometric data of millions of users in the provider’s single infrastructure. Such centralization turns the cloud platform into an attractive target for cybercriminals — a successful attack can provide access to the biometrics of all the provider’s customers at once.
In local systems, data is distributed among the independent servers of different organizations. Hacking one company affects only its customer base. In the cloud model, compromising the central infrastructure can simultaneously affect hundreds of client organizations. According to IBM Security, the average size of a breach in cloud environments is 4.45 million records versus 2.1 million in local systems.
The multi-tenant architecture of cloud platforms creates additional attack vectors. Vulnerabilities in the mechanisms for isolating data between clients can lead to unauthorized access to another’s biometrics through neighboring virtual environments. Incidents of leaks through vulnerabilities in hypervisors or container environments are regularly recorded in the cloud infrastructure of the largest providers.
Centralized storage also simplifies the mass extraction of data when the provider’s administrative accounts are compromised. A single entry point with maximum privileges gives potential access to the entire biometric database, whereas in a distributed local architecture such a possibility does not exist.
Third-party access and contractor chains to biometric data
Cloud KYC providers rarely manage the entire infrastructure themselves. A typical chain includes:
- the main KYC service provider,
- the cloud platform (AWS, Google Cloud, Azure),
- subcontractors for individual components (CDN, backup, monitoring),
- external machine learning services for processing biometrics.
Each link in this chain potentially has technical access to the biometric data. Administrators of the cloud platform can gain access to virtual machines and storage. The provider’s technical support specialists often have the ability to view data to diagnose problems. Developers of integrated services can receive biometrics for processing by recognition algorithms.
Controlling third-party access is complicated by the legal specifics of different countries. The legislation of some jurisdictions requires providing access to data to law enforcement without notifying the information owner. The Cloud Act in the US allows American authorities to demand access to data from cloud providers regardless of the geography of its storage.
Auditing the actions of all participants in the chain is practically impossible. The client organization cannot control exactly which of the provider’s or subcontractors’ employees accessed the biometric data, what operations were performed, and whether any unaccounted copies were created. The standard logs of cloud platforms usually record only high-level operations without detail on specific biometric records.
Risks of the cross-border transfer of biometrics and a change of storage country
The global infrastructure of cloud providers implies the replication of data between data centers in different countries to ensure fault tolerance. Biometric data initially uploaded to a Russian data center may be automatically replicated to Europe or Asia for backup or load balancing.
The cross-border transfer of biometrics creates legal uncertainty. The data falls under the jurisdiction of the country of storage with all the ensuing requirements of local law. The Russian Federal Law 152-FZ requires storing the biometrics of RF citizens on the territory of Russia, but it is technically extremely difficult to track all data movements in cloud infrastructure.
Providers can change the geography of their server placement for technical or economic reasons without agreeing it with clients. A change in the geopolitical situation, the introduction of sanctions or a change in tax legislation lead to the relocation of data centers to other countries. Clients learn about such changes after the fact, when the biometrics is already in the new jurisdiction.
Routing traffic through the territories of third countries creates additional risks of intercepting biometric data. When transmitting between data centers, information passes through backbone communication channels that may be controlled by security services or attackers. Even when encryption is used, the metadata about the biometrics transfer remains visible to the communication operators.
Dependence on the cloud provider: incidents, bankruptcy, policy changes
A critical dependence on a single cloud provider creates operational risks for storing biometrics. Technical failures on the provider’s side can make biometric data unavailable for hours or days, paralyzing customer verification processes. Major incidents with the unavailability of AWS, Azure and Google Cloud services occur several times a year, affecting thousands of companies simultaneously.
| Category | Description |
|---|---|
| Bankruptcy or sale of the cloud provider | Puts the safety and confidentiality of biometrics at risk. New owners may gain full access to the data, change the conditions of its storage, or transfer the information to third parties. Bankruptcy procedures often involve the sale of assets, including databases, to pay off debts to creditors. |
| Unilateral changes to the terms of service | A common practice of cloud providers. Price increases, changes to the SLA, the introduction of new restrictions or requirements occur regularly. Organizations are forced to accept the new terms or urgently migrate biometric data, which creates additional risks of its compromise during the transfer. |
| Account blocking by the provider | Can happen for many reasons: suspicion of violating the terms of use, sanctions restrictions, billing errors, false positives from security systems. Restoring access to biometric data can take weeks, and in some cases the data is deleted irrecoverably. The lack of direct control over the infrastructure makes the organization a hostage to the provider’s decisions. |
Risks of storing biometrics in local (on-premise) KYC
Local deployment of a KYC system gives the organization full control over the biometric data, but along with it — full responsibility for its protection. Companies gain independence from external providers, but face a set of technical, organizational and operational challenges that, if insufficiently addressed, turn into critical vulnerabilities.
Requirements for one’s own infrastructure and cybersecurity team
Organizing local storage of biometrics requires creating a secure infrastructure that complies with the ISO 27001 standard, the requirements of Federal Law 152-FZ, and the provisions of Bank of Russia Regulation 382-P. Server hardware must be placed in certified data centers of Tier III level or higher with redundancy of power, cooling and communication channels. For biometric templates ranging from 512 bytes to 2 KB per person, with a base of 100,000 customers, a minimum of 200 GB of secure storage will be required, taking into account indexes, metadata and redundancy.
Ensuring cryptographic protection becomes critically important: encryption of data at rest (AES-256), in transit (TLS 1.3), and the use of hardware security modules (HSM) for key management. The cost of a single HSM module starts at 500,000 rubles, and to ensure fault tolerance a minimum of two devices is required. Backup systems must operate on the 3-2-1 principle: three copies of the data, two different types of media, one copy off the main site.
The staff of information security specialists to support a local biometric system includes a minimum of 4-5 qualified employees: a security architect (from 250,000 rubles/month), a security administrator (from 180,000 rubles/month), a SOC incident monitoring specialist (from 150,000 rubles/month), a backup engineer and a compliance auditor. The annual costs of the team’s salaries alone exceed 10 million rubles, not counting training, certification and staff retention amid a shortage of qualified specialists.
Internal threats: administrators, manual exports, unauthorized copies
Statistics from Positive Technologies show that 35% of biometric data leaks occur through the fault of insiders — employees with legitimate access to systems. Database administrators and system administrators have the technical means to copy biometric templates, even with formal prohibitions in place. Standard DLP tools are not always effective against a qualified specialist who knows the system architecture.
Technical support and debugging procedures pose a particular danger. When investigating incidents, migrating data or fulfilling regulators’ requests, a need arises for manual exports of biometric information. Each such operation creates a point of risk: the data may be copied to unprotected media, sent over unencrypted channels, or saved in intermediate systems without proper lifecycle control.
Access control mechanisms are complicated by the specifics of biometric data. Unlike ordinary personal data, a biometric template cannot be changed after compromise — a person cannot “change their face” like a password. Implementing the “four eyes” principle for critical operations requires additional organizational measures: two-factor authorization for administrative access, video recording of work in server rooms, and regular rotation of administrative passwords and tokens.
Risks of loss, damage and unavailability of biometric data
Local storage of biometrics is subject to the risks of physical data destruction. The fire at the OVHcloud data center in Strasbourg in 2021 led to the irreversible loss of data for 3.6 million websites, including the biometric databases of several European companies. A similar incident at the Russian DataLine data center in 2024 showed the vulnerability of even certified sites to force majeure circumstances.
Logical data corruption poses no less of a threat. Errors in updating a database schema, incorrect migration between DBMS versions, and failures in file systems can lead to the corruption of biometric templates. Recovery from backups takes from 4 to 48 hours depending on the volume of data and the system architecture, which means a complete halt of customer verification processes for this period.
The human factor exacerbates the technical risks. Accidental deletion of a production database instead of a test one, errors in maintenance scripts, incorrect replication configuration — each of these scenarios is regularly realized in corporate infrastructures. According to the Veeam Data Protection Report 2024, 75% of companies have encountered data loss incidents due to human error, with the average volume of unrecoverable data amounting to 35% of the volume lost.
Dependence on local hardware creates the risk of prolonged service unavailability. The failure of a RAID array controller, the degradation of SSD drives, or software licensing problems can lead to downtime of several hours to several days. Under current conditions, procuring and replacing specialized equipment for biometric systems takes from 2 to 8 weeks, which is critical for business processes tied to the remote identification of customers.
Cloud KYC vs local on-premise KYC: comparing the security and risks of storing biometrics
The choice between cloud and local storage of biometric data in KYC systems is determined by the balance between control, flexibility, costs and risks. Each model has its own advantages depending on the size of the business, the regulatory landscape and security requirements. A direct comparison shows that there is no universal solution — the optimal choice depends on the specific threat profile and operational capabilities of the organization.
The threat matrix: which risks are higher in cloud KYC and which in local
The distribution of risks between cloud and local KYC is uneven and depends on the nature of the threats.
| Category | Description |
|---|---|
| Risks that predominate in cloud KYC: | – Data concentration creates an attractive target for cybercriminals. Hacking one cloud provider can compromise the biometrics of millions of users from dozens of client companies. Supply chain attacks through subcontractors of the cloud infrastructure represent an additional threat that is difficult to control on the customer’s side. – Loss of control over physical access to the servers means the need to trust the provider’s security procedures. Changes in the storage policy or the migration of data between data centers occur without the direct participation of the biometric data owner. – Regulatory risks increase with the cross-border transfer of data, especially when the cloud infrastructure is distributed across several jurisdictions with different personal data protection requirements. |
| Risks that dominate in local KYC: | – Operational failures and the human factor manifest more acutely without a cloud provider’s professional team. Insufficient qualifications of one’s own administrators, outdated backup procedures, or the untimely updating of security systems create vulnerabilities that are closed automatically in the cloud. – Physical threats to the infrastructure — from fire to a power outage — require significant investment in redundancy and protection. Organizations can rarely provide a level of physical security comparable to the tier-3 or tier-4 data centers of cloud providers. – Internal threats statistically represent a greater risk in the local model. Administrators with full access to the system, the ability to create unauthorized copies of biometric data, and the lack of separation of duties in small IT departments — all of this increases the likelihood of insider incidents. |
| Parity risks: | – Some threats are equally relevant to both models. Attacks on the application layer of the KYC system, vulnerabilities in encryption algorithms, and social engineering against employees — these risks require equal vigilance regardless of where the data is stored. |
Scenarios where the law requires local storage of biometrics
Russian legislation establishes strict requirements for the localization of the biometric data of RF citizens. According to Federal Law No. 152-FZ “On Personal Data”, the biometric data of Russian citizens must be processed using databases located on the territory of Russia.
For credit institutions, Bank of Russia Regulation No. 683-P of 16.12.2019 establishes additional requirements for information protection during the remote servicing of customers. Combined with the Bank of Russia’s sectoral clarifications and the requirements for the UBS, this effectively greatly limits the possibility of storing customers’ biometric data in public clouds — in practice, banks use their own controlled infrastructure or the UBS state information system.
State information systems that process biometric data must be hosted exclusively in state data centers or on critical information infrastructure facilities with the appropriate significance category.
Personal data operators working with the biometrics of minors are obliged to ensure a heightened level of security (UZ-1), which in practice requires full control over the storage infrastructure.
In the international context, requirements vary. China prohibits the export of its citizens’ biometric data outside the country. India requires biometrics to be stored within the country as part of the Aadhaar system. The European Union allows the cross-border transfer of biometrics only to countries with an adequate level of data protection or with the appropriate GDPR safeguards in place.
When cloud KYC is secure with the right architecture and configuration
Cloud storage of biometrics becomes a secure solution when architectural principles are followed and modern protection mechanisms are used.
Contractual guarantees are also critically important: a clear delimitation of responsibility in the service level agreement (SLA), obligations to notify about security incidents within 24-72 hours, the right for the customer to conduct an audit, and guarantees of data deletion after the contract is terminated.
With proper implementation, cloud KYC provides an availability level of 99.95% and higher, automatic scaling under load, geographic redundancy and a professional security team — advantages that are difficult and expensive to reproduce in the local infrastructure of a mid-sized business.
How to choose a biometrics storage model for KYC to fit your requirements
The choice between local and cloud storage of biometric data determines the architecture of the entire identification system, affects the project budget and the speed of launch. The right decision depends on the combination of regulatory requirements, acceptable risks and the economic factors of a specific business.
Assessing regulatory restrictions and industry standards for the business
The first step in choosing a storage model is an audit of the applicable regulatory requirements. In Russia, for most companies, the basic requirements of Federal Law 152-FZ apply, which allow cloud storage of biometrics if certain conditions are met: data encryption, contracts with operators, and hosting in the Russian jurisdiction.
However, individual business segments face additional restrictions. Banks working with the Unified Biometric System (UBS) are obliged to transfer biometric templates to centralized storage through secure channels. Insurance companies and NPFs follow the Bank of Russia’s cybersecurity guidelines, which prescribe heightened requirements for data residency. Government customers and companies with state participation are often restricted by requirements to host critical information exclusively in certified data centers or their own infrastructure.
International companies additionally take into account GDPR requirements when working with European clients. The regulation requires explicit consent to process biometrics, the conduct of a data protection impact assessment (DPIA), and limits cross-border transfer. The American standards BIPA (Illinois) and CCPA (California) impose similar restrictions with an emphasis on retention periods and the right to delete biometric data.
Industry standards also influence the choice. Companies in the payment industry follow the requirements of PCI DSS, which, although it does not regulate biometrics directly, establishes general principles for protecting sensitive data. Medical organizations are guided by the Ministry of Health’s orders on telemedicine, where the biometric identification of patients requires special protective measures.
A practical approach: compile a matrix of applicable requirements, highlighting the mandatory and advisory norms. If the mandatory requirements unambiguously prescribe local hosting, the choice is obvious. In other cases, proceed to a risk analysis.
Analyzing the risk profile and the acceptable level of a biometric data leak
Biometric data cannot be changed like a password, so assessing the acceptable level of risk becomes critically important. The risk profile is determined through an analysis of three parameters: the volume of biometrics processed, the criticality of the identification processes, and the reputational consequences of a possible leak.
The volume of data directly affects the attractiveness to attackers. A company with a base of 10,000 biometric templates is of less interest than a service with millions of records. At the same time, the qualitative composition of the base can outweigh the quantitative: the biometrics of VIP customers, top management or public figures require enhanced protection regardless of the volume.
The criticality of processes is assessed through the potential damage from compromise. For payment services, where biometrics is used to authorize transactions, a leak can lead to direct financial losses. In access control systems at restricted facilities, compromise creates physical security threats. For marketplaces or dating services, the consequences are limited to reputational damage and user churn.
The methodology for assessing the acceptable level of risk includes calculating the maximum possible damage from an incident: direct financial losses, regulatory fines (up to 18 million rubles under Federal Law 152-FZ), the cost of restoring systems, compensation to users, and a drop in capitalization. The resulting amount is compared with the probability of the threats materializing for each storage model.
The cloud model statistically shows a lower probability of successful attacks thanks to the providers’ professional security teams and regular audits. However, the consequences of a successful attack can be larger in scale due to data centralization. The local model demonstrates the reverse dependence: a higher probability of incidents due to the human factor, but a limited scale of consequences.
Companies with a low tolerance for risk (banks, government agencies) traditionally choose local hosting for full control. Startups and technology companies more often accept the residual risks of the cloud model in exchange for the speed of deployment and resource savings.
Taking TCO, implementation speed and scaling into account when choosing cloud or local KYC
Economic parameters often become the deciding factor of choice after passing the regulatory and risk filters. Calculating the total cost of ownership (TCO) for a biometric system requires a planning horizon of at least 3-5 years.
For local hosting, the capital costs include: server hardware taking redundancy into account (from 3 million rubles for a minimal configuration), software licenses, data storage systems with replication, information security equipment, and operating expenses.
The cloud model involves predictable operating expenses: a subscription fee or payment per transaction (from 10-25 rubles per verification), with no capital investment. Additional costs are limited to integration and configuration.
The speed of implementation differs by a wide margin. Cloud KYC is launched in 1-2 weeks: registration, obtaining API keys, integration, testing. Local deployment takes 2-6 months: procuring hardware, deploying the infrastructure, installing and configuring the software, training staff, certification.
Scaling determines the flexibility of the business. Cloud solutions scale automatically: growth from 1,000 to 100,000 verifications a day occurs without the client’s involvement. Local infrastructure requires capacity planning and the procurement of additional hardware, and can become a bottleneck during sharp growth.
Hybrid models combine the advantages of both approaches: critical data is stored locally, while computing power is rented in the cloud. Biometric templates remain under the company’s control, while resource-intensive comparison operations are performed on cloud infrastructure.
The decision-making algorithm:
- Regulatory requirements prohibit the cloud → local hosting
- Data volume < 50,000 profiles, no special requirements → a cloud solution is economically justified
- High criticality, low risk tolerance → local or hybrid hosting
- Fast scalability needed, limited IT staff → the cloud model
- Limited budget at the start, speed of launch is important → cloud KYC with a transition to hybrid as it grows
Choosing a biometrics storage model is a balance between control and efficiency. Local hosting provides maximum control at the cost of high expenses and management complexity. Cloud solutions ensure a quick start and flexibility with the residual risks of dependence on the provider. The right choice takes into account the specifics of the business, the company’s development stage and the long-term strategy for working with biometric data.
Neither local nor cloud storage of biometric data guarantees absolute security — each model carries specific risks and requires different competencies. Cloud KYC provides fast integration, scaling and professional infrastructure protection, but creates dependence on the provider and is associated with the threats of centralized storage. Local deployment provides full control, simplifies compliance with strict regulatory norms and rules out the transfer of data to third parties, but requires investment in hardware, licenses and a security team.
The decision is made on the basis of a systematic analysis: checking the applicable legislation, assessing the threat profile, calculating the total cost of ownership, and forecasting the load. With the right architecture, access control and regular audits, both models are able to reliably protect biometrics — the important thing is to choose the one that fits the business’s objectives, minimizes the risks critical to it, and ensures sustainable compliance with regulatory requirements.
