This article is pending privacy or legal review and explains planned BorrowHive product behavior.

Audience: support,ops · Review status: privacy or legal review pending · Effective: 2026-05-19 · Last reviewed: 2026-05-19

Identity verification incident response

This article explains BorrowHive product behavior. It is not legal or tax advice, and it is not a safety guarantee.

Use this runbook when Stripe Identity or BorrowHive verification handling may be affecting many members, redaction requests, or verified-person gates. Identity verification is separate from asset-label mailer verification, address checks, payout onboarding, and verified inventory.

Incident Types

• Stripe Identity provider outage or elevated API errors.
• Stripe Identity webhook delivery failure, signature mismatch, or redacted-event delay.
• Incorrect mass rejection, mass action-required status, or unexpected gate blocks.
• Raw ID, selfie, full document number, client secret, hosted URL, Stripe verified_outputs, or provider payload appears in BorrowHive logs, tables, screenshots, or support tickets.
• Failed provider redaction retries remain unresolved.

Immediate Actions

• Pause rollout escalation and keep transaction gates fail-closed if status accuracy is uncertain.
• Confirm provider status, webhook subscription, and recent webhook delivery for identity.verification_session.* events.
• Review only non-PII BorrowHive fields: verification ID, provider session reference, safe failure category, status, redaction status, attempt count, and timestamps.
• Do not send ID photos, selfies, document numbers, or raw provider outputs through ordinary support forms, chat, email, or messages.
• If raw identity material entered BorrowHive systems, treat it as a privacy incident, preserve minimum audit evidence, redact or delete the material, and add a regression test.

Member Communication

Send the verified-person guide or troubleshooting article. Explain whether the member should wait, retry the Stripe Identity flow, or contact support without attaching sensitive identity images.

Do not claim that verified-person status is a background check, credit check, guarantee of safe behavior, address guarantee, or BorrowHive endorsement.

Verified-person status is not a background check, not a credit check, not an address guarantee, not a guarantee of safe behavior, and not a BorrowHive endorsement.

Recovery Checks

Before closing the incident, verify provider API health, webhook processing, support/admin queue counts, redaction retry status, gate-block volume, and conversion impact. Record the timeline, affected environments, affected article versions, and any follow-up tests or rollout flag changes.