Knowledge-Based Authentication (KBA) Policy

KBA is performed in accordance with the MISMO RON standard, which generally requires at least five dynamically generated questions drawn from authoritative public-records data, of which the signer must correctly answer at least four within two minutes.

Signers are allowed a limited number of attempts within a 24-hour period. Exceeded attempts result in session termination and may delay rescheduling.

Questions are generated by third-party identity proofing vendors using public-records data. NexusSeal does not retain the question content; it retains the pass/fail outcome and audit metadata.

KBA requirements vary by state. The Platform enforces the applicable jurisdiction’s rules. See our Compliance Center for state-by-state detail.

KBA processing is subject to our Privacy Policy and vendor agreements that restrict use of the data to identity verification only.