AI-assisted identity verification for online services.
Identiwise checks that an uploaded image really is an ID document, matches the face on it against a selfie, reads the document with OCR and scores the text against the details the person gave you. One REST API, a hosted verification page for the subject, an admin review console for your team — all processed in the EU.
What a verification does
Three checks run inside the API call that uploads the image, and the result comes back in the response. On a document or selfie submission, anything the models cannot decide — including a check that could not run — is parked for a human in your review queue with the reason stated; on the standalone age check, which has no queue behind it, the API returns an error rather than a verdict.
Document detection
A custom-trained document-detection model confirms the frame actually contains an ID document before anything is read from it. Today the detector is trained on US (Texas) driver's licences; further document classes are on the roadmap.
Face matching
A facial-recognition model compares the portrait on the document with an approved reference selfie, and cross-checks the secondary "ghost" portrait on the document against the primary one. An image with no detectable face is never scored as a match.
OCR cross-check
An OCR engine reads the document and the extracted text is scored against the details the subject provided — name, date of birth, licence number, street — with region-agnostic date handling. The score is stored as evidence for whoever reviews it.
One long-lived credential. Short-lived tokens for everything else.
Your backend authenticates with a bearer token and mints a scoped token per verification. The subject's browser only ever holds the scoped one. Verification results arrive in the HTTP response of the upload — there are no callbacks to configure.
Ephemeral tokens
Client-side uploads without exposing a long-lived key. Expiry, number of uses and each capability are set per token.
Hosted verification UI
A mobile-friendly page the subject opens with that token: camera capture, QR hand-off from desktop to phone, details form, re-upload and messages. Or build your own against the same API.
Presets & workflows
Save a token template as a preset, and define an ordered list of steps the hosted page renders as a wizard.
Security & data privacy
GDPR: you stay the controller
Identiwise acts as processor. Subjects and your administrators can lodge erasure requests (Art. 17) through an admin privacy queue, and an append-only audit log records document views, data exports, review decisions, logins, role changes and erasures.
Encrypted in transit, private object storage
Every hostname is served over TLS. Uploaded images sit in private object storage and are never served publicly — administrators open them through time-limited pre-signed URLs (15 minutes). Console access adds TOTP two-factor authentication, tenant-wide 2FA enforcement and a per-tenant IP allow-list.
Data sovereignty
Customer data is processed and stored on IONOS Cloud in Frankfurt, Germany, and nowhere else. Sub-processors are EU-based. There is no other region to choose.