Uploading and storing Passport photos securely

[OWelch]

Hi all, hoping for some architectural advice, I've been given a requirement where customers need to upload passport photos, so we can use that passport info to make travel bookings on their behalf. Once uploaded we would store the passport photo for 1 year, at which point we would re-request the upload from the customer. 

I'm building a scoped app, with a public portal page containing a record producer. The passport image is then attached and submitted, which then lives as an attachment on the csm_consumer record (so in the sys_attachment table). ACL's would then limit the number of people who can view the image. 

Is there a better approach? I'm unsure if this is secure enough, we do not have edge encryption configured and so I believe ServiceNow staff could gain access. Is there a risk with the images being stored in sys_attachment?

Thanks in advance for any advice 

[boteeuwen]

Hi OWelch,

I’d probably avoid storing the passport image directly on the csm_consumer record. It will work, but for something this sensitive I’d rather keep it separate and lock it down more strictly.

For example, you could create a custom table like x_your_app_passport_vault and store the attachment there. Add a reference back to the consumer, plus fields like upload date, retention until, status and verified. That way normal CSM access stays separate from the passport data.

I’d also create a dedicated role for the small group that really needs access and use strict ACLs on that table. On top of that, I’d check what encryption options you have available, for example KMF or attachment encryption. I would verify the exact setup with ServiceNow though, especially if the requirement is that admins or ServiceNow staff should not be able to read the image.

For the one year retention, a scheduled flow could check for expired records, delete the related attachment, set the status to pending reupload and ask the customer to upload a new passport.

I’d also ask whether the full image really needs to be stored for the whole year. If you only need a few passport details after verification, deleting the image earlier would reduce the risk quite a bit.

If this helped, could you mark it as helpful or as the solution?