Entrust

Document intelligence and facial biometrics do the judging, with deepfake, synthetic identity and injection attack detection alongside. Orchestration, data connections and the authentication products would still be useful without the models.

Trained analysts review and validate model outputs, and about 3 percent of all checks are sampled at random each month to measure accuracy. In certain products, human specialists assess results in real time when the models meet unusual or uncertain inputs, and models pass dashboard review and controlled A/B tests before release. Selfie Auto and Motion compare faces with no human review, while document, face and proof of address checks can route to reviewers at named outsourcing firms. Workflow Studio sets which checks apply to which users.

Every Consider result carries a breakdown of the reasons, drawn from the models and any human review behind the check. False acceptance and false rejection rates are estimated on a random sample of production checks but not published, and the validation work is not tied to a supervisory framework. iBeta certified the liveness models at presentation attack detection Level 1 for selfie and Level 2 for motion under the ISO 30107 3 protocol.

Principal Financial Group raised authentication success 10 percent, cut abandonment 34 percent and went from selection to full deployment in under five months, while MACH lifted conversion 48 percent. Revolut and the UK Home Office, for its Electronic Travel Authorization system, are also named.

Check data from every customer trains the shared models by default, and a customer can opt out through account configuration. An opt out removes its checks from model training and from the monthly quality sample, though pseudonymized, aggregated data may still feed analytics and benchmarking. How long training data is kept is not published. Data is encrypted in transit and at rest, and access to the models and their data is limited to staff whose work requires it.

Entrust acts as processor for the institution under its identity verification product privacy notice, last updated September 30, 2026, which sets out what each check handles, from document images and extracted fields to face scans, device signals and data provider results. Retention follows the institution's instructions within limits Entrust sets.

Face scans from a biometric check are not kept once the check completes, and scans held for repeat fraud checks or authentication are capped at 365 days. A public subprocessor list names every party that touches user data, with its location and purpose. Onfido Ltd acts as controller when check data is used to develop the service, where the law allows.

Entrust's ISO/IEC 27001:2022 certificate covers the whole organization and can be downloaded, the identity verification business carries its own ISO 27001 certificate from ControlCase that a buyer can check on the certifier's site, and ISO 27701 adds a privacy management certification audited every year. A SOC 2 Type II report is named but not offered for download, and detailed penetration test results stay inside Entrust unless law or regulation requires otherwise. A vendor information security addendum is published, and the identity verification service runs its own vulnerability disclosure program.

Certification at the high confidence H1A profile under the UK Digital Identity and Attributes Trust Framework, whose certified services sit on a public register, comes with European Telecommunications Standards Institute (ETSI) TS 119 461 certification for identity proofing. Accredited bodies assess services under that framework before they are listed.

Performance is evaluated regularly across countries, continents and genders, and when a gap appears the training data, sampling or calibration is adjusted. Per group error rates and the full evaluation method are not published. The transparency notice names the likely sources of bias, from training data that overrepresents some regions to image quality and capture conditions, and points to the report the Information Commissioner's Office published on Onfido's time in its regulatory sandbox.

Reports carry reasons for every Consider result, and an email address takes reports of inaccurate results. A guarantee, an accuracy commitment or an alternative evidence route for a person turned away is not offered. The product privacy notice says the institution alone decides how to act on a report, which places the loss with the customer, and a person who fails a check is sent to the institution to exercise data rights.

The core models are deep learning models fine tuned on Entrust's own data, and the pretrained models they start from, including the vision language model behind document extraction, are not named. A public subprocessor list covers every party that touches user data, with location and purpose: Amazon Web Services for hosting and processing, Microsoft for speech to text in video checks, data providers including Equifax, Experian, LSEG, ComplyAdvantage and Mastercard, and outsourcing firms such as Concentrix and Teleperformance for human review.

Verification flows into debit card issuance on the issuance infrastructure the firm supplies to bank branches, and integrations are named with Microsoft Entra Verified ID, Entra ID and Okta Workforce Identity. A Google Cloud partnership extends the reach into account recovery and workforce verification.

Verification data is hosted on Amazon Web Services in the institution's choice of European Union, Canada or United States instance, and Microsoft's speech service for video checks runs in the matching West Europe, East US or Canada Central region. Support and review staff at Entrust's outsourcing firms reach that data from India, Vietnam and Bulgaria.

Every route is a contact request, with no pricing or basis of charge for verification sold alone or within a wider identity portfolio. Charging per check or per protected customer is left unsaid.

Financial services has its own banking page and use case sequence from onboarding through authentication to card issuance, with named financial customers. Government, travel and gaming sit beside it as other verticals.