Sumsub Know Your Customer (KYC) Integration Guide
8. Security Requirements
Client systems must protect KYC credentials, applicant data, and review results across API, webhook, and operational workflows.
On this page
| Requirement | Description |
|---|---|
| Server-side credentials | Sumsub App Token and Secret Key must stay on the backend that signs API requests. |
| No frontend secrets | Never expose Sumsub App Token or Secret Key in frontend or mobile code. |
| HTTPS only | All API and webhook traffic must use secure transport. |
| Access control | Only authorized systems and users may access KYC result data. |
| Data minimization | Store and transmit only required KYC fields. |
| Audit logging | Log applicant identifiers, result, timestamp, sourceKey, and final handling decision. |
| Environment separation | Keep sandbox and production credentials/configuration separate. |
Next steps
Continue to Sandbox Testing for recommended test scenarios and validation steps before production go-live.