Going live

• A production key of its own, with the production webhook URL and its own signing secret. Test and production never share a key.
• The flow asks for what you need and nothing more. Every step costs the person time and costs you per check.
• Retention (images and personal data) matches your obligations.
• Webhook route is HTTPS, checks every signature, answers within 20 seconds, and handles repeats.
• Failure paths work: rejected, needs_manual_review, expired, the API unavailable (503), the prepaid balance used up (402).
• Someone handles manual reviews in the operator console (Verifications), so people aren’t left waiting.
• Your privacy notice tells people that ZetaID performs the identity check on your behalf.
• Monitoring: alert when webhooks stop arriving or the API answers errors.

During operation

• The operator console shows every verification with its steps, the images (as long as you keep them) and the result.
• Billing shows usage, invoices or your prepaid balance and top-ups.
• If you suspect a key leaked, replace it and rotate its signing secret.