Security & Biometric Verification

Your Data Security is Non-Negotiable

Traditional agencies manually store your passport and driving license screenshots, leaving you exposed to data breaches. CastingCrowd leverages instantaneous biometric verification so your physical identity documents are never saved or exposed on our servers.

Zero-storage biometric verification · Bank-grade encryption

The Old Way vs. The CastingCrowd Way

How identity verification should work in 2026 — and why the legacy approach puts artists at risk.

Column A

The Old Way

  • Manual document uploads — passport and license screenshots stored on agency servers
  • Vulnerable to server breaches (the 2023 Entertainment Partners incident exposed 471k artists and cost a $9.5M settlement)
  • Photocopied ID held in shared drives, inboxes and spreadsheets
  • No automated identity binding — documents can be reused or shared
Documents sit on someone else's server — for years.
Recommended

Column B

The CastingCrowd Way

  • Zero-storage biometric verification — your raw document photo is never saved
  • Live facial matching instantly binds identity to your profile
  • Fully automated, encrypted verification handled by Stripe Identity
  • Verification result replaces the need to re-upload documents for every job
Your identity is verified, never stored.

How Verification Works

Three steps. Under two minutes. Your documents never touch our database.

01

Scan

Quickly capture your government ID using your phone camera. The image is used only for this session — it is never saved to our servers.

02

Liveness Check

Take a brief 3D selfie to confirm real presence. Our liveness detection prevents spoofing with photos, masks or pre-recorded video.

03

Verified

Our biometric handshake instantly validates your profile without saving your raw document photo. A verification result replaces repeated physical ID checks.

Powered by Stripe Identity. The same bank-grade infrastructure trusted by global financial institutions — now protecting the people who make film and TV.

Legal Identity

A registered, accountable company

CastingCrowd is operated by a real, registered UK company — not an anonymous website. Production companies and actors can verify our legal identity through official public registers at any time.

Companies House

No. 16975080

England & Wales

Verify on public register

ICO Registration

ZC214276

UK data protection

Verify on ICO register

Registered Office

3rd Floor, 86-90 Paul Street

London, EC2A 4NE

England, United Kingdom

Identity

How identity verification works

Verification is a Stripe Identity liveness check that produces a verified result on an artist's profile. It is optional on sign-up and required for Studio Security Clearance.

  1. 01

    Create a free profile

    Performing artists, background actors and extras create a profile at no cost. A profile is usable for casting before any identity check is completed.

  2. 02

    Start a biometric check

    A verification session is created with Stripe Identity. The artist captures a government-issued photo ID and takes a short liveness selfie, which Stripe compares to confirm the person is physically present.

  3. 03

    Result recorded on the profile

    The verification outcome is written back to the artist's profile and shown as a verified badge. Raw ID images are held by the verification provider, not saved as profile data — retention details are set out below.

  4. 04

    What prevents duplicate profiles

    Each account email can hold one artist profile: the profile is saved against the signed-in email and can only be created or edited by the account that owns it. Agency and production accounts are reviewed by a person before they are activated. The platform does not claim automated biometric matching of one face across separate accounts.

Verification provider
Stripe Identity
Check performed
Government photo ID plus biometric liveness

Questions about deleted or expired verification data can be sent to privacy@castingcrowd.com. See also what data we store.

Data

What data we store and for how long

This table lists the records the platform holds about an artist account and how long each is kept.

Profile information

Until the artist deletes the profile or requests erasure.

Name, contact details, measurements, skills and photos that the artist enters or uploads.

Identity verification result

Two years from the verification date, then a 30-day grace period before the badge is hidden until renewal.

The pass/fail outcome and verification date recorded on the profile. Raw ID images are held by Stripe Identity.

Contracts and signatures

For the life of the agreement, then for the statutory accounting period (six years in the UK).

Signed contract text, signer name, timestamp and integrity hash, retained so both parties can evidence what was agreed.

Bookings and payments

Invoice, payslip and payment records are kept for the statutory accounting period (six years in the UK).

Booking records and transaction references processed by Stripe. Card and bank details are not stored by the platform.

Erasure requests

31-day grace period from the request, then permanent purge.

An account flagged for deletion leaves public and agent-facing surfaces immediately, then data is purged on a scheduled date.

Data we do not hold: raw passport or driving-licence images on our servers, card numbers, or bank account credentials. Full detail on legal basis and erasure rights is in our Privacy Policy.

Contracts & NDAs

How contracts and NDAs are signed

Production contracts, NDAs and agency agreements are signed digitally and sealed with a hash so the executed text can be proven unchanged.

Identity is checked before a signature is accepted

Contract signing is a signed-in action tied to the account that owns the contract and the artist email on the record. Signature steps can additionally require a one-time access code sent to the signer's email.

Tamper-evident record

Each signature stores the signer's name and email, a timestamp, the IP address and user agent at signing, and a SHA-256 seal computed over the contract content and signature details. If the stored text is altered afterwards, the seal no longer matches.

Integrity can be re-verified

The stored integrity check recomputes the seal on demand, so a signed contract can be evidenced as unchanged rather than relying on a screenshot.

Audit trail

Signing events (sent, viewed, signed, voided, countersigned, expired) are recorded chronologically against the contract. Each audit entry stores the contract reference, the acting account's email, the action, a free-text detail field, the IP address and the timestamp. Entries are append-only — the interface offers no way to edit or delete an audit event.

Not claimed: the platform does not re-run a biometric check each time a contract is signed. Signing relies on the authenticated account and, where enabled, a one-time email access code.

Access

Access controls

Who can see a record is decided server-side, and sensitive documents are never served from a public link.

Account authentication

Accounts are password-protected, with optional two-factor authentication for artist and agency accounts. Sign-in and security events are recorded in an authentication log.

Role-based access

Every account has a role — artist, agency or administrator — and data access is enforced by role at the database level, not only in the interface. Artists see their own records; agencies see the talent data their role permits; administrative actions are restricted to administrators.

Private by default

Profiles are not publicly listed by default. An artist can create a shareable public profile, which exposes only the photos and measurements that artist selects. Nothing else becomes public through that link.

Files and transfers

Uploaded documents are stored privately and served through short-lived signed links. SceneSend transfers can be PIN-protected and expire.

Payments

Card payments and artist payouts are processed by Stripe, including Stripe Connect for artist payouts. The platform does not store card numbers or bank account details. Stripe's own security and compliance documentation governs the payment layer.

Compliance

Regulatory position and reporting

Company and data-protection registration details below are public and can be checked against Companies House and the ICO register.

Legal entity
Casting Crowd Limited, company number 16975080 (England & Wales)
Registered office
3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE
Data protection
Registered with the UK Information Commissioner's Office, reference ZC214276. Personal data is processed under UK GDPR.
Contract integrity
Executed contracts are sealed with a SHA-256 hash and can be re-verified on demand, with a dated audit record of every signing event.
Erasure
Artists can request account deletion in-product. Public exposure is removed immediately and data is purged after a 31-day grace period.

Report a security issue

If you believe you have found a vulnerability, send the steps to reproduce it through the contact page. Please do not test against live production data or other people's accounts.

Last updated: 30 October 2026