How Safe Is Your Facial Recognition Data?

It might seem like every time you turn around, you’re getting an email from a provider that’s had an unauthorized access event.

You’re told to change your password, freeze your credit, and watch your accounts. From Equifax to AT&T, breaches seem to be everywhere. Verizon's Data Breach Investigations Report analyzed more than 22,000 confirmed data breaches in its 2026 edition.

Most stolen data can be replaced. A face cannot. That is what sets biometric data, from facial recognition data to fingerprints and iris scans, apart. For a sheriff or jail administrator weighing facial recognition, the question is not whether this data is valuable. It is how well it is protected.

Facial recognition data is a mathematical map of a person's face, called a face vector, that the system compares instead of the photo itself. It is safe when the organization holding it requires consent before the data can be used, encrypts the data at rest and in transit, isolates each agency's data, restricts access by role, and follows state biometric privacy law.

In corrections, that discipline protects inmates, officers, and the facility's liability position.

Three key takeaways:

• Matching uses face vectors, not photos, and only while a person’s enrolled.

• Data is encrypted at rest and in transit, and each agency’s data sits in its own isolated database.

• Access is limited by role, and a formal incident response plan covers recovery and customer notification.

How Is Your Facial Recognition Data Encrypted?

Command Cloud is hosted on AWS, where stored files are encrypted at the storage layer, and connections to Command Cloud from browsers and devices use TLS encryption.

Encryption is paired with data segregation. Each agency's data lives in its own database, isolated from every other customer. Within that database, face vectors are kept in their own table, and they can only be used for matching while the person's consent record is active and has not been revoked.

Who Can Access Your Biometric Data?

Access is controlled at two levels: who at your agency can see biometric data, and how the platform itself is protected.

At your agency, access follows the principle of least privilege: each person gets only the access their job requires. Your system administrator assigns users to permission groups in Command Cloud, and each group carries only the permissions that role needs. Viewing biometric enrollment history requires its own permission, and users who leave the agency are disabled.

On the platform side, GUARDIAN RFID aligns its security controls with the NIST 800-53 baseline. All data is hosted in AWS data centers in the United States, behind a web application firewall and inside a virtual private cloud. The environment is scanned for vulnerabilities daily, patched weekly, monitored continuously for anomalies, and penetration tested. Every facial recognition verification attempt at release is logged, whether it is accepted or failed, along with the officer, the inmate, the device, and a timestamp.

What Happens If There Is a Breach?

No vendor is immune to a breach, so what matters is what happens next. Command Cloud is monitored continuously, and anomalies alert on-call security staff. Once an incident is declared, GUARDIAN RFID follows a formal incident response plan that covers both recovery and notifying affected customers. Data is backed up on a rolling hourly, daily, and weekly schedule.

How Long Is Your Biometric Data Stored?

Face vectors are retained for as long as the agency uses the system. Biometric activity records, such as inmate movements captured by facial recognition and their confidence scores, are kept for a minimum of five years. Your agency owns its data. If an agency ends its agreement, GUARDIAN RFID continues hosting the data for up to 12 months while coordinating a transfer in a format both sides agree on.

A person can opt out, or an administrator can revoke their enrollment, at any time. Once enrollment is revoked, that person's face vectors can no longer be used for matching. Officers who enroll to log in to handhelds by face follow the same consent rules.

What Privacy Laws Protect Biometric Data?

In the U.S., state laws such as the California Consumer Privacy Act (CCPA) and Illinois' Biometric Information Privacy Act (BIPA) regulate how biometric data is collected, used, and stored. Most of these laws are written for private businesses, and some, including BIPA, exempt contractors working on behalf of a government agency. Even so, they set a useful benchmark for how biometric data should be handled.

Today, Illinois, Texas, and Washington have standalone biometric privacy laws, and about 20 states have comprehensive consumer privacy laws that also cover biometric data. Here are the three standalone laws:

• Illinois' Biometric Information Privacy Act (BIPA) governs how organizations collect, store, and protect biometric data such as fingerprints, facial recognition data, and retinal scans.

• The Texas Capture or Use of Biometric Identifier Act (CUBI) requires businesses to inform people and get their consent before capturing a biometric identifier for a commercial purpose.

• Washington’s biometric identifiers law (RCW 19.375) requires notice and consent before a business enrolls a biometric identifier for a commercial purpose, and it requires reasonable care to guard against unauthorized access.

You should not have to take a vendor's word for it. See how Command Cloud handles consent, encryption, and access control, and bring your security team's questions to the demo.

Frequently Asked Questions

Is facial recognition data stored as a photo of my face?

Not only as a photo. Enrollment photos are kept in encrypted storage, but matching uses a face vector, a numeric template of the face, rather than the image itself.

What happens to biometric data if there is a breach?

GUARDIAN RFID declares an incident and follows a formal response plan that covers recovery and customer notification. Each agency's data is isolated in its own database, and backups run on a rolling hourly, daily, and weekly schedule.

How long does GUARDIAN RFID keep biometric data?

Face vectors are kept for as long as the agency uses the system, and biometric activity records for at least five years. If an agency ends its agreement, its data is hosted for up to 12 months while a transfer is arranged.

Which laws govern biometric data in the U.S.?

Requirements vary by state. Illinois (BIPA), Texas (CUBI), and Washington (RCW 19.375) have standalone biometric privacy laws, and about 20 states, including California under the CCPA, cover biometric data in broader consumer privacy laws.