KYC / Identity Verification Platform
Verify your customers' identity in seconds
End-to-end identity verification infrastructure combining OCR, NFC chip verification, ML-based liveness analysis and biometric face matching in a single session flow.
- ≈2 min
- Average end-user flow
- 4
- Document types: ID, passport, license, permit
- 3
- Sanctions lists — OFAC · UN · EU, synced daily
- 3
- SDK platforms — Web, Flutter, React Native
Capabilities
What we do
Every verification check your compliance and fraud teams need — each built on transparent, auditable algorithms, behind one API and one session flow.
Document Verification
A PP-OCR based engine reads document fields with high confidence, while the MRZ is decoded via a separate path calibrated for OCR-B. ICAO 9303 check digit validation, cross-field consistency checks and ELA (Error Level Analysis) tamper detection; blur and brightness quality gates reject poor captures upfront.
PP-OCRICAO 9303ELA
NFC Chip Reading
The chip of eMRTD-compliant documents is accessed over a BAC-encrypted channel (Secure Messaging); DG1/DG11/DG12 data groups are read. ICAO 9303 Passive Authentication: hashes in the SOD prove data integrity, and the Document Signer certificate signature proves the data was genuinely issued by the state.
eMRTDBAC/SMPassive Auth
Liveness Detection
Three layers of assurance: server-verified active challenges (blink, head turn), passive anti-spoofing with a MiniFASNet ensemble (two models sensitive to print, screen replay and moiré artifacts), and LBP/FFT/YCrCb heuristic signals. A nonce + TTL mechanism blocks replay attacks.
MiniFASNetMediaPipeAnti-replay
Face Matching
ArcFace embeddings biometrically compare the document photo against the liveness selfie; faces with low SCRFD detection scores (blurry/partial) are rejected at a quality gate. Every approved face is stored in pgvector — if the same face re-enrolls under a different identity, a duplicate signal is raised.
ArcFaceSCRFDpgvector
AML Screening
OFAC SDN, UN Consolidated and EU FSF sanctions lists are synced daily. Names are normalized and screened with fuzzy, token-based matching; date-of-birth mismatches automatically eliminate false positives. No match ever auto-rejects — the decision is always left to a human.
OFAC SDNUNEU FSF
Web & Mobile SDKs
The iframe-based Web SDK communicates securely via postMessage; your tenant API key never reaches the browser — short-lived JWTs are used instead. Flutter and React Native SDKs support the full flow including NFC reading. Results are delivered to your system via HMAC-SHA256 signed webhooks.
WebFlutterReact Native
Flow
How it works
Six steps, from opening the session to a signed webhook reaching your system — the end-user part takes about 2 minutes.
Session Creation
Your backend opens a session. The tenant API key never reaches the browser; the SDK works with a short-lived JWT.
POST /v1/sessions · X-Api-Key
Document Capture
The user photographs their document — with automatic card detection and cropping — or reads its chip via NFC.
auto card detection · MRZ scan · NFC
Document Analysis
OCR, MRZ and chip data are verified with cross-checks; visual quality and authenticity scores are produced.
18 document checks · weighted score ≥ 70
Liveness + Face
Active and passive liveness layers run; the selfie is biometrically matched against the document photo.
3 liveness layers · ArcFace matching
AML & Decision
The name is screened against open sanctions lists and a duplicate-face check runs; a match never auto-rejects — it goes to a human.
OFAC · UN · EU · duplicate-face check
Result & Webhook
The decision settles as approved, manual review or rejected, and is instantly delivered to your system via a signed webhook.
HMAC-SHA256 signed webhook · GET /{id}/result
Security & Compliance
Audit-ready infrastructure
The proof of how a decision was made matters as much as the decision itself.
Audit Trail
Every state transition is written to a timestamped event log — full traceability.
Signed Webhooks
All result notifications are signed with HMAC-SHA256; their origin is verifiable.
PII Retention Policy
Personal data is automatically and permanently deleted at the end of its defined retention period.
Abuse Protection
Rate and velocity limits, sandbox/production isolation, per-session attempt caps.