How does this Integration work?
Identity Screening by Checkr Trust (previously Tessera Data) provides a comprehensive data set to screen any individual entering your business. When a visitor is invited or signs in with Envoy, Identity Screening will automatically check if their information appears on denied party lists, sex offender lists, terrorist watchlists, or wanted person lists. You can configure which categories visitors should be screened against and who should be notified if there's a match. Visitors who are matched via the dataset will not be able to enter your workplace and will require review from your team to enter.
You can opt to screen all visitors or only certain visitor types and configure what information is included in checks to get broader or more exact matches.
How visitors experience screening
Visitors will have no way of knowing that they are being screened or that they’ve matched a restricted party. If you would like to proactively let visitors know that they will be screened and collect their consent, you can optionally use Envoy’s legal documents with a pre-configured form related to Identity Screening or the communication channel of your choosing to do so.
What happens when there is a match?
When a visitor returns a match through the Identity Screening integration, Envoy notifies the administrators you’ve designated to receive alerts. These people will receive alerts through the preferred notification channels set in their profile.
In the Visitor log, any pending invites will show at the top of the entry list. You can ✅Approve or ❌Deny from this screen, or click on View details to pull up the entry.
Within the entry, clicking Review will open the screener window, where more details can be seen.
The History log will be updated to show which admin approved/denied the visit, and when they did so.
Match Alerts
Note: You must log in to your Envoy account to view the full screening results in the dashboard.
Using Checkr with Approval workflows
Approval workflows are currently Early Access only; skip to Configure Identity screening.
Identity Screening can run as a distinct step in an approval workflow policy. Learn more about using screeners with policies.
Policies work slightly differently than standard invite or entry screening. In order to use Identity Screening with a policy:
You must install the integration at every location. Install Identity Screening at each location that uses the policy. Integrations are installed by location, so you'll need to install it at each location one by one. If Identity Screening is missing at a site using the policy, admins will receive a warning when saving.
Refer to the History log for results. When Identity Screening runs as part of a policy, the standard visitor screening status (under Access Control) shows that the screener did not run. This is expected. The screener did run, and the policy log has the result.
Remove the screener from any pre-existing visitor configurations. Since this screener will occur in the policy, you can remove the location-level sign-in flow from the integration. This is step 3.1 shown below. If you have sign-in flows that won't use a policy that includes Checkr, be sure to leave it on!
Configuring Identity Screening
Steps 1 and 2: Agreement and Screening Options
Navigate to Integrations > All Integrations in the Envoy dashboard.
Search for Identity Screening and click Install on the corresponding result.
On the Agreement step, click Authorize to give the integration the permissions it needs to proceed. Then view the Terms of Service and make sure the “I Agree to the Terms of Service” checkbox is checked.
On the Screening Options step, choose the types of records to match against the dropdown:
[Optional]: Choose to allow records without a listed date-of-birth.
Off: only records that match on name and DOB reach your team.
Fewer false positives, and you lose any designation published without a DOB.
On: name-only matches reach your team too.
You catch those designations, and your team reviews more false positives.
[Optional]: Set a Lookback period to only search records for a set number of years. The default is 30 years.
[Optional] Set a Persist Approval window, which allows you to skip re-screening returning visitors for a set number of days. This is recommended if you often have recurring invites at your site.
[Optional] Check the box next to Skip incomplete invites to prevent the screening from occurring before all required fields are populated.
Click Next Step to continue to the Visitor setup.
Step 3: Visitors
On the Visitor step, choose the Visitor types to screen against.
Leave this blank if you plan to use this integration with an approval workflow policy.
Choose the date-of-birth field name and format. This field will be created automatically in your sign-in flow.
If you want to automate DOB collection with ID Scanning, you must select YYYY-MM-DD.
[Optional]: Select recipients who will receive a report if a matching record hits.
Click Complete Setup to save the configuration.
Automating Date of Birth collection
By working in tandem with our ID Scanning feature, you can automatically pull Date of Birth information from Visitor-provided IDs.
Enable ID Scanning for your sign-in flow.
Install Identity Screening as directed above.
Within the applicable sign-in flows, click Field options.
Under ID Scanning, match the sign-in field Date of birth to the Identification field Date of birth.
Navigate to the Respondents field option. Hide the field "Date of birth" from employees and visitors. This ensures that the field is only populated by the ID Scanning automation.
Click Save.
Frequently asked questions
What are the data retention policies?
Checkr retains background screenings for 90 days and then automatically purges PII (including DOB).