How Purple Visits protects prison video calls: encryption in transit and at rest, Cyber Essentials Plus, face checks, what's recorded and who can see it.
Your security and privacy matter to us. We understand that trust is essential when you’re using a service that connects families with loved ones in prison, a secure hospital or a secure training centre. This page explains, in plain terms, how we protect you, your data and your video calls – and what the establishment can see.
Purple Visits video calls and personal data are encrypted in transit and at rest (AES-256). Calls are recorded by the establishment and may be monitored, as prison phone calls are. Purple Visits is Cyber Essentials Plus certified, uses UK-based servers, and complies with UK GDPR. Identity checks and face verification make sure only approved people are on a call. This article explains each of these, and what you can do to keep your own account safe.
Encryption scrambles information so that it can only be read by someone with the right key. If the data is intercepted on the way, it’s unreadable.
Encryption stops outsiders from seeing your call or your data. It doesn’t make the call private from the establishment. Video calls are recorded by the establishment and may be monitored, in the same way that prison phone calls are. This is a requirement of the Prison Service and applies to all secure video calling, not just Purple Visits. Because of this, Purple Visits is not “end-to-end encrypted” in the way a personal messaging app might be – the establishment can access recordings. See Call monitoring and recording below.
Face recognition is a safeguarding and security measure required by secure establishments. It makes sure only approved people are on a call, prevents account sharing, and protects the person in prison from contact with people they shouldn’t have contact with.
Before a call, you take a security selfie in the waiting room. The system compares it with your verified ID photo. Only the main account holder needs to do this before each call.
During the call, the system keeps checking the faces on screen against the people approved for that call. If someone who isn’t approved comes into the frame, the call pauses until they leave the frame. It then resumes.
Face data is used only for verification. It isn’t shared with third parties, and it’s kept only for as long as we’re required to keep it.
Learn more in During your video call and Video calls with children.
Before you can use Purple Visits, we verify who you are. You upload government-issued photo ID (passport, driving licence or CitizenCard), a proof of address dated within the last 3 months, and a selfie. We check that the details match and the documents are valid.
This is required by the Prison Service for anyone contacting someone in custody. It also protects you, by stopping anyone else from opening an account in your name.
Verification usually takes less than one working day. See What ID do I need? for the full list of accepted documents, and Verifying your identity for photo tips.
Before each call, you take a security selfie. This confirms you’re the verified account holder and stops someone else from using your account. For the best result, sit in good light, look straight at the camera, and keep your full face visible. Selfies are used only for verification and are deleted after the retention period.
All video calls are recorded by the establishment and may be monitored. This is the same as prison phone calls. It exists to keep the establishment secure, to protect vulnerable people, and to meet legal requirements. It isn’t unique to Purple Visits.
The full video and audio of the call, call details (date, time, length, participants), security selfies and face verification data during the call.
You must not record calls yourself, take screenshots, or film the call with another device. Doing so can lead to account suspension and loss of call privileges, and may have legal consequences. This protects everyone on the call, including the person in prison.
Purple Visits is approved and funded by the Ministry of Justice, and the establishment you call is responsible for the security checks and recordings described above. We use a small number of third-party providers, each under a data processing agreement:
You can change your cookie choices at any time using the Cookie preferences link in the footer of this website. See our Cookie policy for more.
Learn more in Your data rights.
Cyber Essentials Plus is a UK government-backed security certification. Unlike the basic version, “Plus” means an independent assessor tests our systems hands-on, every year. It covers firewalls, secure configuration, access control, malware protection and security updates.
For you, it means our security has been checked by someone outside Purple Visits, not just by us. You can check our certification on the official Cyber Essentials register.
We do a lot to protect you, but some things are in your hands.
If you notice anything odd – someone else logging in, unexpected activity, or a security worry – email [email protected], use live chat in the app, or use the contact form. We take every report seriously.
Are prison video calls private? Your call is encrypted so outsiders can’t see or hear it. But the establishment records the call and may monitor it, in the same way as prison phone calls. Establishment staff and, with legal authority, law enforcement can access recordings.
How secure are my video calls? Calls and data are encrypted in transit and at rest (AES-256). Our systems are independently tested under Cyber Essentials Plus. Calls are recorded by the establishment, as prison phone calls are.
Who can see my call recordings? Authorised establishment staff for security or safeguarding purposes, and law enforcement with legal authority. Purple Visits staff have minimal access for technical support only.
Is my personal data safe? Yes. It’s encrypted in transit and at rest, stored on UK-based servers with strict access controls, and handled in line with UK GDPR.
Can someone hack my account? We use several layers of protection. You can help by using a strong, unique password and never sharing your login.
What if there’s a data breach? We have incident response procedures and would tell affected users promptly, as the law requires.
More questions? Contact us.
For general support or security concerns, email [email protected] or use our contact form. We usually reply within one working day.