• Identity startup ID.me has won dozens of contracts to provide verification for government agencies.

• As it grew rapidly, it left some user data exposed on internal chat rooms and dashboards, an Insider investigation found.

• Democratic Sens. Ron Wyden, Ed Markey, and Bob Menendez called ID.me's handling of information "careless" and urged federal privacy legislation.

Three Democratic senators this week criticized identity verification contractor ID.me's privacy and security standards after an Insider investigation found user data was left unsecure on internal dashboards. The senators, Robert Menendez of New Jersey, Ron Wyden of Oregon, and Ed Markey of Massachusetts, called the company's handling of personal information "reckless" and "irresponsible" in statements to Insider.

Data for any ID.me user, which included veterans and people seeking unemployment benefits, was easily accessible with a company laptop for most customer service workers, sometimes before background checks were complete, Insider previously reported. Some customer service workers were instructed to screenshot and upload users' personal documents (including passports, driver's licenses, and Social Security cards) to an internal Slack channel if they needed help verifying whether they were fake or real.

ID.me has won contracts with the Internal Revenue Service, Social Security Administration, Department of Veterans Affairs, and dozens of state unemployment agencies for its identity verification product. Most of those deals were closed in the last two years, during which time the company grew rapidly, hiring nearly 1,500 people and setting up new offices in Tampa, Florida, Insider previously reported.

Menendez, who was the lead signatory on a February letter to the IRS commissioner expressing concerns about ID.me, said he was troubled by the information Insider found.

"I have repeatedly expressed concerns about the amount of data and information that is collected and retained by companies like ID.me," Menendez said in an email to Insider, which he then posted on Twitter. "This report reveals that my concerns were justified--given the careless, irresponsible, and improper manner in which taxpayer information was handled by ID.me's employees."