Most questions about identity verification are really questions about storage. Not whether the check works, but where the passport photograph ends up and who can still reach it next year.
A single verification passes through three places. Each one has a different job, and each one gives the document back.
The device
Capture happens where the person is: a phone, a kiosk, a thin client at a counter. The device reads the document, checks the security features it can check on its own, and holds the image only while the check is running.
Nothing is written to the device's storage. When the session closes, the frame is gone with it.
The cloud
What the device cannot decide alone travels encrypted to the processing layer, which compares the document against the reference for its type and country, and the face against the document.
The processing layer is transit, not a filing cabinet. It holds the payload for the duration of the request and releases it when the answer is produced.
The image is evidence during the check and a liability afterwards. Only the outcome is worth keeping.
The audit record
What survives is the record: which checks ran, what each one returned, when, and against which reference. It is what your compliance team reads and what a regulator asks for.
It contains no document image. A record that had to carry the passport photograph to be useful would put the risk back exactly where the rest of this design took it out.
Why it is split this way
Because the three places fail differently. A lost device, a breached server and a leaked archive are three separate incidents, and a design that keeps the document in all three turns any one of them into the same headline.