Data Security and KYC on 8lends: How Data Is Protected
Passport photo, selfie, wallet address — who actually holds your data on 8lends, and why the platform physically cannot touch your funds.
8lends works with two categories of sensitive data: KYC data (document photo, selfie, personal information) and on-chain data (wallet address, transaction history). KYC data is stored with Sumsub — a provider with ISO 27001 and SOC 2 certifications and GDPR compliance, not with 8lends. On-chain data is public by the nature of blockchain. The platform operates under a non-custodial model — 8lends does not have the private key to your wallet and physically cannot withdraw funds. AML screening of the wallet is mandatory for all investments — this is a basic regulatory requirement.
What data 8lends collects
| Category | What it includes | Where it is stored |
|---|---|---|
| KYC data (identity) | Passport/ID photo, selfie, name, date of birth, citizenship, address | With Sumsub, not with 8lends |
| AML data (wallet) | Wallet address, transaction history, risk scoring | With AML provider + on-chain |
| Transactional data | Investments, payouts, claims, sales on the Secondary Market | On-chain (public) + personal dashboard |
| Email and notifications | Email (optional), notification settings | With 8lends, encrypted |
| Contact data | Support requests, correspondence | With 8lends |
KYC data — who stores it and how it is protected
KYC is completed through Sumsub — an international identity verification provider used by major exchanges (Binance, OKX, Bybit) and regulated financial platforms.
Sumsub's certifications and standards:
- ISO 27001 — international information security standard
- SOC 2 Type II — audit of security, availability, and confidentiality controls
- PCI DSS — payment data protection standard
- GDPR compliance (EU) — personal data protection requirements
- CCPA compliance (California) — privacy rights
- GDIC (Global Digital Identity Certification) — Sumsub was the first provider to receive this certification (August 2024)
What this means in practice:
- 8lends does not store the document photo and does not store the selfie — after KYC they remain only with Sumsub
- Encryption at rest — data at Sumsub is encrypted on the storage side
- Encryption in-transit — data transfer over TLS
- Regular external audits — ISO 27001 and SOC 2 standards require annual checks by independent auditors
- Biometric data is processed according to the ISO/IEC 30107 standard (Biometric Presentation Attack Detection)
AML wallet screening — mandatory for all
For every investment (including under $500 without KYC), the wallet undergoes automatic AML screening. This is a basic regulatory requirement (PCMLTFA in Canada, FATF Travel Rule).
What is checked:
- Sanctions lists: OFAC (USA), UN, EU, HM Treasury (UK)
- Connection to crypto mixers (Tornado Cash and similar)
- History of interaction with darknet services
- Connection to known fraudulent addresses or hacks
- Connection to jurisdictions on sanctions lists
What is NOT required for AML:
- Identity documents (this is KYC, not AML)
- Selfie or biometrics
- Employer information
AML works only with the public on-chain data of your wallet. No private information is needed for the check.
On-chain data — what is public and what is not
The Base blockchain is public by nature. This means:
What is publicly visible:
- Your wallet address
- The full transaction history for that address
- Balances of USDC, ETH, and other tokens
- Interaction with the 8lends smart contract
- The amount of each investment and which project it went into
What is NOT publicly visible:
- Your identity (name, passport) — this is off-chain at Sumsub
- The link between the address and a real person
- The content of support messages
This is pseudonymity — your wallet is visible to everyone, but without KYC data, third parties do not know who owns it. 8lends knows the "address ↔ KYC" link within its own system, but does not publish it on-chain.
Non-custodial model — what it means for security
8lends operates on a non-custodial principle: the platform has no control over your funds.
What this means technically:
- 8lends does not know your seed phrase — only you know it
- 8lends does not have the private key to your wallet
- Every transaction requires your signature in the wallet (MetaMask, Trust Wallet)
- The platform cannot deduct USDC without explicit confirmation through the wallet
- If 8lends servers are hacked, your funds remain on the blockchain under your control
Risk surface — what is reduced
Comparative table of custodial vs non-custodial risks:
| Scenario | Custodial platform (exchange) | 8lends (non-custodial) |
|---|---|---|
| Server hack | High risk of losing funds | Funds on the blockchain are safe |
| Platform bankruptcy | Funds frozen, return not guaranteed | Funds available in the wallet |
| Regulator shuts down the platform | Withdrawal access blocked | Funds remain on-chain |
| Loss of platform password | Recovered through KYC | Not applicable (no password) |
| Loss of wallet seed phrase | Not applicable | Funds lost forever |
The investor's main responsibility in the non-custodial model is keeping the seed phrase safe.
Data retention periods
| Type of data | Retention period | Basis |
|---|---|---|
| KYC data | At least 5 years after the end of the relationship | PCMLTFA (Canada), FATF Recommendation 16 |
| AML checks | At least 5 years | FATF, PCMLTFA (Canada) |
| Transactional data | At least 5 years | PCMLTFA (Canada) |
| Email and support correspondence | Up to 3 years after the relationship ends | GDPR + business needs |
| Session cookies | Session (until the browser is closed) | Technical |
The periods comply with international standards, including FATF Recommendation 16 and the recordkeeping requirements of the Canadian PCMLTFA. Data may be retained beyond the basic minimum in cases where the data is critical for ongoing investigations or legal proceedings.
Your rights as an investor
In accordance with GDPR (for EU residents) and similar rules in other jurisdictions, you have the right to:
- Request a copy of your data — what data is stored, where, and in what format
- Request correction of inaccurate data
- Request deletion of data (with caveats — some data must be retained under AML)
- Object to data processing for marketing purposes
- Request data portability — receive data in a machine-readable format
- File a complaint with the supervisory authority of your country of residence
To exercise these rights — contact [email protected] specifying the particular request.
Wallet security — on the investor's side
8lends protects data on its side, but wallet security is the investor's responsibility. Basic recommendations:
- Write down the seed phrase on paper, store it separately from the device, not in the cloud or on your phone
- Never share the seed phrase with anyone, including "8lends support" (we do not request it)
- A hardware wallet (Ledger / Trezor) is the best option for large amounts
- Two-factor authentication on email and exchanges
- Anti-phishing: always check the URL — only app.8lends.io, no clones
- Regular updates to the wallet and operating system
- A separate wallet for investments — do not mix it with your wallet for DeFi experiments
More on scam protection
Regulatory data protection
| Regulator / regulation | What applies to 8lends |
|---|---|
| PCMLTFA / FINTRAC (Canada) | AML/CFT, customer identification, recordkeeping, reporting to FINTRAC |
| PIPEDA and PIPA (Canada, British Columbia) | Protection of personal data |
| FATF Travel Rule | Transfer of sender/recipient transaction data |
| GDPR (for EU clients) | Rights to access, deletion, portability |
| CCPA (for California clients) | US equivalent of GDPR |
| PolyReg SRO / FINMA | Swiss AML standards via Maclear AG |
What 8lends does NOT do with data
- Does not sell data to third parties
- Does not use KYC data for marketing or advertising
- Does not transfer biometrics to third parties (it remains with Sumsub)
- Does not publish the "address ↔ identity" link on-chain
- Does not store payment information (cards are processed by Meld.io)
- Does not have access to your private key or seed phrase
Frequently asked questions
Where exactly are the photos of my documents stored? With Sumsub — the KYC provider. Sumsub has data centers in the EU (for GDPR compliance) and in the USA. The exact geographic placement is in the Sumsub Privacy Policy. 8lends receives from Sumsub only the result of the check (passed/rejected/pending), not the documents themselves.
Can someone find out that I invest on 8lends through the blockchain? It is visible that your wallet address interacts with the 8lends smart contract — this is public. But who is behind that address is not published. The "address ↔ identity" link is known only to 8lends and Sumsub in their internal systems, and is not disclosed publicly without a legal basis.
What if I am hacked and my seed phrase is stolen? This is a critical situation. 8lends cannot return the funds — the wallet and its contents are fully controlled by the seed phrase. This is a basic property of Web3. That is why protecting the seed phrase is the most important aspect of personal security.
Can the regulator request my data from 8lends? Yes, if there is a lawful basis (a court request, an AML/CFT investigation, a tax audit with international legal assistance). 8lends is obliged to provide data to the regulator upon request — this is a standard norm for all regulated financial platforms. But without a lawful basis, data is not provided.
Does 8lends report data to tax authorities? Not automatically. 8lends does not file tax reports on your behalf: declaring your income is your responsibility as an investor. Upon an official request from a tax authority (for example, through international legal assistance), data is provided.
What if Sumsub is hacked? Sumsub has ISO 27001, SOC 2 Type II, and regular external audits. This reduces the risk but does not eliminate it entirely. In the event of a breach, Sumsub is obliged to notify users and regulators in accordance with GDPR. For the user, this means a risk of a leak of KYC data (document photo, selfie) — the same risks as in a hack of any bank or exchange with KYC.
How do I delete my data from 8lends? Through a request to [email protected]. The following will be deleted: email, support correspondence, marketing data. The following cannot be deleted (due to regulatory requirements): KYC data and AML checks (at least 5 years according to FATF / the Canadian PCMLTFA), transaction records. After the regulatory periods expire, the data is deleted.
Is it safe to hold large amounts on 8lends? 8lends is a non-custodial platform, so funds are not on 8lends but in your wallet. "Large amounts on 8lends" technically means "large amounts in my wallet, invested in 8lends smart contracts." The protection is:
- A hardware wallet (Ledger/Trezor) for large amounts
- CertiK + Cyberscope audits for 8lends smart contracts
- Diversification across several projects
- A backup wallet for other experiments
Does 8lends use cookies or tracking? Only technical cookies for the interface to function. Marketing tracking is used minimally — only aggregated analytics are used, with no link to a specific user.
Where can I find the full text of the Privacy Policy? On app.8lends.io in the documents section — Privacy Policy and Terms & Conditions. These documents are updated regularly as the regulatory environment changes.
See also:
Disclosure: 8lends is a platform operated by CLEARCHAIN CORP, registered with FINTRAC (Canada) as a Money Services Business. Maclear AG (Switzerland), a member of PolyReg SRO under the supervision of FINMA, acts as Collateral Agent. KYC through Sumsub complies with the customer identification requirements of the PCMLTFA (Canada). Sumsub holds ISO 27001, SOC 2 Type II, PCI DSS certifications and GDPR compliance. Regulatory framework as of September 2026.