01
Biometrics
Tenant isolation
Biometric matching stays within a workspace so identities do not leak across customer boundaries.
HaloKYC / Security
Sensitive data deserves deliberate boundaries.
HaloKYC is designed around short-lived capture data, tenant-scoped identity records, traceable decisions, and callbacks your backend can authenticate.
- Isolation
- Tenant-scoped
- Callbacks
- HMAC-SHA256
- Decisions
- Actor-attributed audit
Security principles
Controls that follow the identity lifecycle.
Security is applied from browser capture through the final backend notification, with a clear boundary for each stage.
02
Transport
Signed delivery
HMAC-signed webhook payloads let your backend reject unauthenticated callbacks.
03
Accountability
Audit history
Review decisions and delivery attempts retain the actor, reason, status, and timestamp.
04
Evidence
Private handling
Capture files stay behind private storage boundaries and are not exposed through public URLs.
We take your users' data personally.
Identity files are the most sensitive data your product touches. We designed the system around what gets deleted, who can see what, and why the audit trail exists — before the first line of AI code was written.
- ISO-aligned
- Construction, not certification
- Tenant-scoped
- Data isolated per workspace
- Ephemeral
- Object URLs revoked on unmount
- Signed
- HMAC-SHA256 · SHA-256
Soft and permanent bans keep a face embedding on file so a new selfie does not restart the process without your team noticing.
Selfie and ID images are processed, checked, then discarded. Biometric embeddings are tenant-scoped and never cross workspaces.
Evidence lives under a private storage layer. Object URLs are revoked on unmount. The file path is never exposed to the browser.
Only a verified hash and the extracted fields needed for the check are stored. Raw document numbers are never persisted or surfaced in any API response.
Every approve, reject, and override is logged with the reviewer's identity, the evidence they saw, and the reason they wrote.
Every webhook is signed with HMAC-SHA256. Your backend fails closed on any payload that does not verify — no exceptions.
Verification work runs asynchronously. Long-processing sessions do not block your API, and sessions queued while credits are empty show a neutral waiting state to the user.
Wallet, ledger, and reservation records are taggable and auditable. Compliance exports include every credit movement without manual reconstruction.
Ready when you are
Inspect the controls before you integrate.
Review the data-handling model, then use the sandbox to trace a verification from evidence to signed result.