Trusty reads the identity document, confirms a live person with a guided video selfie, matches the face, and returns a signed decision — inside one iframe on your page.
Runs on the Cloudflare edge — decisions close to your users
The whole check runs inside one iframe. Your backend receives exactly one signed webhook per verification.
The user photographs their passport, national ID or driver’s license in a guided capture — on the same device, or handed off from desktop to their phone via QR.
Vision models extract the holder’s data into structured JSON and check expiry dates and field consistency.
A short guided video selfie confirms a live person is present: challenge-response, screen-recapture and printed-photo signals.
The live face is compared with the document photo. You receive a signed decision — approved, declined or review — with evidence retained.
Each capability feeds the next. The output is always the same: a decision you can defend.
The visual zone and MRZ are parsed into structured JSON — names, numbers, dates — with expiry and consistency checks on every field.
A guided video selfie with challenge-response captures the signals that flag screen recaptures and printed photos.
The face captured during liveness is scored against the document portrait. The similarity score travels in every decision payload.
Approved, declined or review — each outcome is signed, searchable in the per-tenant backoffice, and backed by retained evidence.
{ "event": "kyc.verification.completed", "status": "approved", "verification_id": "ver_9f2c41", "checks": { "document": "valid", "liveness": "pass", "face_match": 0.98 }, "metadata": { "userId": "123" } }
Users verify without leaving your page — no app installs, no redirects that kill conversion.
The same document–selfie–match sequence for every onboarding, so outcomes stay comparable across cohorts.
Recapture, printed-photo and mismatch signals are detected automatically before a verdict is issued.
Signed, evidence-backed results your compliance team can search, audit and explain.
Embed one iframe. Verify one signature. Your users never leave your page.
Paste a single iframe tag with your public token and optional passthrough metadata.
Every decision arrives with an HMAC-SHA256 signature. Compare in constant time, then read the payload.
<iframe
src="https://trusty.sh/verify?public_token=TR_PUB_XXX&metadata=%7B%22userId%22%3A%22123%22%7D"
style="width:100%;max-width:420px;height:640px;border:0"
allow="camera">
</iframe>import { createHmac, timingSafeEqual } from 'node:crypto'
const expected = createHmac('sha256', process.env.TRUSTY_WEBHOOK_SECRET)
.update(rawBody)
.digest('hex')
const valid = timingSafeEqual(
Buffer.from(signatureHeader), // X-Trusty-Signature
Buffer.from(`sha256=${expected}`)
)
if (valid) {
// event: kyc.verification.completed
// status: "approved" | "declined" | "review"
// metadata: your passthrough JSON, intact
}Public documentation and sandbox are in progress. Request access with your sales contact.
Request developer accessContexts where a structured KYC check changes the risk profile of onboarding. Presented as use cases, not client claims.
Verify customers before granting access to regulated financial products such as accounts, cards and credit.
Support age and identity checks during player onboarding and account review.
Verify sellers, professionals or high-risk users before enabling sensitive actions such as payouts.
Anchor wallet opening and fiat on-off ramps to a real, verified identity.
Gate regulated or high-trust actions behind an identity check without breaking the user flow.
Identity evidence demands the highest care. Every layer of the platform is designed around that fact.
TLS 1.3 in transit and server-side encryption at rest for every biometric artifact we store.
Images live in non-public buckets, reachable only through authenticated, audited proxy endpoints.
Public tokens only work from domains you explicitly whitelist — spoofed embeds are rejected at the edge.
Each client gets an independent webhook signing secret. Rotate it anytime from the dashboard.
Short-lived JWT sessions with SUPER_USER and CLIENT_ADMIN roles, strictly scoped per tenant.
Your metadata passes through untouched. PII is isolated per tenant and deleted on cascade.
Designed for GDPR-aligned data handling. Certification programs (ISO 27001, SOC 2) are not yet published — ask your sales contact for the current status.
One metric, no hidden costs, no egress surprises.
100 verifications included / month
then $0.90 per additional verification
For evaluation and small pilots.
from 2,500 verifications / month
For products running in production.
Unlimited volume, custom pricing
For regulated and high-volume teams.
Trusty reads identity documents, confirms liveness with a guided video selfie, and matches the captured face with the document photo. The result is delivered as a signed decision — approved, declined or review — with retained evidence.
A user opens the embedded iframe, presents an identity document, completes a short video selfie, and Trusty returns a structured decision through a signed webhook. Cross-device handoff lets desktop sessions continue on the user’s phone camera.
The guided video selfie uses challenge-response and captures liveness signals that flag screen recaptures and printed photos. Those signals, plus the face-match score, feed every decision.
Vision models read passports, national IDs and driver’s licenses into structured JSON. For document coverage specific to your markets, ask your sales contact.
The verification flow runs in any modern browser through a single iframe. Desktop sessions can hand off to the user’s phone camera via a secure QR code — no app install required.
Each decision is delivered to your endpoint as an HTTP request with an HMAC-SHA256 signature in the X-Trusty-Signature header, plus your original passthrough metadata. The event type is kyc.verification.completed.
TLS 1.3 in transit, server-side encryption at rest, non-public buckets behind authenticated and audited proxy endpoints, per-tenant data isolation with cascade deletion, and 90-day default evidence retention. Designed for GDPR-aligned handling.
Book a demo through the contact form or email [email protected]. Average first response is under 4 business hours.
Tell us about your product and what you need to verify. We will get back to you within one business day.
Submitting opens your email client with the message pre-filled, addressed to [email protected].
Book a walkthrough with the Trusty team. We will map the flow to your onboarding step and your compliance process.