Version 1.0 · June 2025
Security Whitepaper
This document describes the technical security measures VerifyID employs to protect your identity data throughout the verification process.
1. Transport Security
All communication between your device and VerifyID servers is protected by TLS 1.3. We enforce HTTPS-only access with HTTP Strict Transport Security (HSTS) headers. Certificate pinning is applied on supported platforms.
2. Face Verification Pipeline
VerifyID uses InsightFace (buffalo_l model) for face matching — a state-of-the-art ArcFace ResNet50 model trained on WebFace600K with a 512-dimensional embedding space.
Face Match
Cosine similarity is computed between the ID document face embedding and the live selfie embedding. A match is confirmed only when similarity exceeds our calibrated threshold, minimising both false acceptances and false rejections.
Liveness Detection
Our multi-frame liveness pipeline analyses:
- Optical flow — detects natural micro-movements absent in printed photos
- Texture analysis — Laplacian variance distinguishes real skin from flat surfaces
- Screen reflection detection — HSV saturation analysis flags screen replay attacks
- Blink detection — eye-area variance across frames confirms a live subject
- Frequency-domain depth — FFT mid-frequency energy confirms 3D scene structure
3. Data Storage
Biometric embeddings (512-d facial feature vectors) are computed in-memory and are not written to persistent storage. Raw selfie frames are discarded immediately after processing. ID document images may be retained for up to 90 days in encrypted object storage for dispute resolution, after which they are permanently and irreversibly deleted.
4. Access Control
Access to verification data is enforced through:
- Role-based access control (RBAC) — only the initiating organisation can view their users' results
- API key authentication with per-key rate limiting
- All administrative access requires MFA
- Audit logs are maintained for all data access events
5. Infrastructure Security
- Servers run hardened Ubuntu LTS with automatic security patching
- Firewall rules allow only necessary inbound ports (443, 80)
- SSH access restricted to key-based authentication
- Database access is restricted to localhost — never exposed to the public internet
6. Rate Limiting & Abuse Prevention
Verification endpoints are protected by per-IP and per-token rate limiting. Repeated failed verification attempts trigger automatic cooldown periods. Suspicious patterns are flagged for manual review.
7. Incident Response
In the event of a security incident, affected users will be notified within 72 hours in accordance with applicable data protection regulations. Our incident response team is available 24/7.
8. Contact
To report a security vulnerability, contact security@verifyid.com. We operate a responsible disclosure programme and respond to all reports within 48 hours.