KYC · AML · LIVENESS · FACE
Verify your customers' identity in seconds
End-to-end identity verification infrastructure combining OCR, ML-based liveness analysis and biometric face matching in a single session flow.
≈2 min end-user flow19 document checks3 liveness layers
Capabilities
What we do
Every verification check your compliance and fraud teams need — each built on transparent, auditable algorithms, behind one API and one session flow.
- DOCDocument VerificationOur in-house OCR model reads document fields with high confidence, while the MRZ is decoded via a separate path calibrated for OCR-B. ICAO 9303 check digit validation, cross-field consistency checks and ELA (Error Level Analysis) tamper detection; blur and brightness quality gates reject poor captures upfront.In-house OCR · ICAO 9303 · ELA
- LIVLiveness DetectionThree layers of assurance: server-verified active challenges (blink, head turn), passive anti-spoofing with our in-house model (trained to catch print, screen replay and moiré artifacts), and LBP/FFT/YCrCb heuristic signals. A nonce + TTL mechanism blocks replay attacks.In-house anti-spoofing · Anti-replay
- FACEFace MatchingOur in-house face model biometrically compares the document photo against the liveness selfie; faces with low detection scores (blurry/partial) are rejected at a quality gate. Every approved face is stored in pgvector — if the same face re-enrolls under a different identity, a duplicate signal is raised.In-house face model · pgvector
- AMLAML ScreeningOFAC SDN, UN Consolidated and EU FSF sanctions lists are synced daily. Names are normalized and screened with fuzzy, token-based matching; date-of-birth mismatches automatically eliminate false positives. No match ever auto-rejects — the decision is always left to a human.OFAC SDN · UN · EU FSF
- SDKWeb SDKThe iframe-based Web SDK communicates securely via postMessage; your tenant API key never reaches the browser — short-lived JWTs are used instead. Results are delivered to your system via HMAC-SHA256 signed webhooks.Web · iframe · postMessage
- AIAI Review AssistantFor every session routed to manual review, Claude drafts a note for the analyst from the check results: a short summary, which signal is suspicious and why, a suggested action (approve, reject or request resubmission) and, for AML hits, why the match may be a false positive. Only scores, check codes and flags reach the model, never images, biometrics or personal data. The decision always stays with a human.Claude · Human-in-the-loop
FOR DEVELOPERS
One POST request. The rest is a signed webhook.
You open the session server-side and send the user to the returned URL. When the decision settles you receive it over an HMAC-SHA256 signed webhook — no polling, no key in the browser.
See integration examples{ "applicant_external_id": "usr_1042" }
# → 201
{ "session_id": "550e8400-…", "sdk_url": "https://verify.idotta.com/session/…" }
# → webhook
X-Signature: sha256=9d41…
{ "status": "approved", "checks": 18 }
TRUST & COMPLIANCE
Verifiable today. Certifications when they are issued.
Every registration below links to its public register. Data protection laws are obligations, not certificates — we show how we meet them, and list certifications only once they are awarded.
REGISTERED
UK Information Commissioner's Office (ICO) — data controllerZC273784valid until 12 October 2027Verify in the public register Companies House — England and Wales17478457IDOTTA LIMITEDVerify in the public registerCOMPLIANCE
Self-assessed, not a certification.
A data processing agreement under GDPR Art. 28 with every customer, published technical and organisational measures under Art. 32, and a public sub-processor list.
IN PROGRESS
ROADMAP · NOT YET CERTIFIED
Ready to integrate?
Get in touch for a sandbox environment, API keys and integration documentation.