Bringing your own encryption key
A Relay claim result is built to hold as little as possible. It says whether a claim passed or failed, and sometimes which method produced it. There is no name, birthdate, or document in it, and Persona deletes the verification data behind it once the result exists.
You can add a further layer on top of that. When you create a Relay session, you can supply your own public key, and Persona encrypts the claim payload with it before returning it, so only the holder of the matching private key can read the result.
Persona recommends it. Relay exists to keep personal data out of places it does not need to be, and encrypting the payload extends that to the result itself.
Whether to use it is your decision. Supply a key and the payload comes back encrypted. Leave it out and it comes back as plain JSON.
What it adds
Encrypting the payload narrows who can read a claim result to exactly one system, the one holding your private key. The result stays unreadable anywhere it might otherwise sit in the clear, including in a log, a proxy, or an intermediate service inside your own infrastructure.
That matters most if the response passes through anything on its way to the system that makes the access decision. If you have a gateway, a service mesh, or a logging layer in between, encrypting the payload keeps the result out of all of them.
How it works
- You generate an asymmetric key pair and keep the private key on your server.
- You pass the public key, PEM-encoded, when you create the Relay session.
- When you redeem the claim, the payload comes back as ciphertext rather than JSON.
- Your server decrypts it with the private key and reads the result.
Persona only ever receives the public half, so Persona cannot read the encrypted payload it produced.
If you do not supply a key, the payload is returned as plain JSON and no decryption step is needed. That is the simpler path for a first integration, and switching to your own key later is a change on your side only.
Full technical documentation
The developer documentation is the source of truth for the field name, the encoding, and the decryption samples:
Plans Explained
Claim payload encryption by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| Claim payload encryption | Available | Available | Available | Available |