Does IDScan need to store the IDs after they've verified them?

If they deleted the IDs within a week of getting them surely the leak would be much smaller.

Making holding data like this a liability that has to be insured, etc... is part of a good solution IMO.