Identity data only works if the people in it are treated fairly and the businesses using it can defend how they got it. Here is exactly how we do it.
We don't scrape LinkedIn
Our data comes from licensed suppliers and consent-aware publisher networks, never from logged-in scraping or fake accounts. Every supplier signs a written promise about how its data was collected. This is a deliberate choice: scraped data is the fastest way to lose a supply line overnight.
Every lookup checks the suppression list
Before we return a person through any product, the tag, the API, MCP, or a bulk file, we check a single global list of everyone who has opted out or asked to be deleted. An opt-out with one customer is an opt-out with all of them.
California DROP, on schedule
We download and process deletion requests from California's Delete Request and Opt-out Platform at the interval the law requires, every 45 days today and every 30 days from 2027.
People only in the US
Person-level identification is limited to US traffic. Outside the US we identify companies only, and only after the site's consent banner records consent where the law requires it.
Global Privacy Control honored
If a browser sends a GPC signal, our tag does not identify that visitor. No settings to change, nothing for the customer to forget.
No sensitive sites
Our Acceptable Use Policy forbids using WhoLayer on sites or pages about health, sexual health, religion, sexual orientation, immigration, or financial hardship, or on sites for children. We suspend accounts that break this rule, and we never sell precise location.
Most vendors quote match rates nobody can check. We will publish ours every quarter, with the method, so you can.
- Holdout set. We keep a set of real visits where the visitor's identity is already known with certainty, for example people who later filled in a form or logged in, contributed by customers who opt in to benchmarking.
- Blind resolution. We run those visits through WhoLayer as if they were anonymous, without the known answer.
- Two numbers, never one. We report the match rate (share of visits where we returned a person) and the accuracy (share of returned people who were the right person). A high match rate with low accuracy is noise you pay for.
- Broken out by B2B and ecommerce traffic, and by device type.
Our first report publishes after 90 days of operation. Until then we don't quote a match rate, because we won't quote one we haven't measured.
SOC 2 Type II
Our audit is in progress. Customers can request our security questionnaire and controls summary now.
Encryption and access
TLS in transit, AES-256 at rest, hashed identifiers for suppression, SSO and MFA for all production access, quarterly access reviews.
Report a vulnerability
Email security@wholayer.com. We acknowledge within 2 business days and won't pursue good-faith research that follows this policy.
Need a security review, a signed DPA, or our supplier list under NDA? Email legal@wholayer.com.
Ready when you are
Install the tag with GPC, suppression, and US-only person matching already on.