How to ensure no PII is permanently stored with passkeys?

How Can Businesses Ensure No PII Is Permanently Stored During Passkey Usage?#

Passkeys are designed to enhance security while minimizing the use of Personally Identifiable Information (PII). By implementing best practices and using privacy-conscious systems, businesses can ensure no PII is permanently stored during passkey operations.

Key Strategies to Prevent PII Storage#

1. Temporary Data Processing Only:

   • During passkey creation or login, PII such as an email address may be temporarily used for user identification.
   • Ensure this data is processed only for the duration of the operation and not stored permanently.

2. Use Unique Identifiers:

   • Replace PII with system-generated unique identifiers (e.g., user UUIDs) to link passkeys with user accounts.
   • This ensures the passkey system operates without requiring sensitive user data.

3. Encryption and Secure Transmission:

   • Encrypt all data transmitted during passkey authentication.
   • This reduces the risk of interception and ensures that temporary data is protected.

4. Audit and Monitoring:

   • Regularly audit systems to confirm no PII is inadvertently stored in logs or backups.
   • Implement monitoring tools to detect and alert on any PII retention.

5. Vendor Assessments:

   • If using third-party passkey solutions, confirm that the vendor adheres to data minimization principles.
   • Ensure contracts explicitly prohibit permanent PII storage.

Example of PII-Free Passkey Flow#

• Step 1: The client device generates a public-private key pair.
• Step 2: The public key is stored on the authentication server, while the private key remains on the client device.
• Step 3: Any user identification (e.g., email) is processed transiently and replaced by a unique user ID for future interactions.

By following these strategies, businesses can adopt passkeys while fully complying with privacy regulations and ensuring user trust.

Read the full article#

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →