Identomat

Models carry the throughput across the core flow: document classification and optical character recognition over more than eight thousand eight hundred document types, digital forgery detection, active, passive and cascading liveness, one to one and one to many face matching, and a face similarity score that drives the decision.

Held at B rather than A on the same reasoning applied to iDenfy and Ondato, the two nearest indexed peers: a material part of the verification chain is deterministic rather than learned, including near field communication chip reads, machine readable zone parsing and document template validation, so stripping the models leaves a reduced but working checking pipeline rather than nothing.

The mechanism is named and positioned: a face similarity score routes each session to automatic approval, automatic rejection or a manual review band against thresholds the customer presets, and a separate operator led video product places a live human interview in the path for cases needing one.

Held at B rather than the iDenfy A because the gate is entirely customer configured with no published default, no stated minimum review band and no vendor staffed adjudication layer, so nothing prevents a buyer from setting the thresholds to approve everything. Worth recording as a favourable disclosure on the other side of the same axis: the vendor states its own staff review cases only when the customer raises a support ticket.

External measurement exists and the subject of the test is identified, which is the discriminator that separated Oz Forensics from au10tix on this axis: the vendor states that its own system defeated three dimensional printed masks, silicone and paper masks, synthesised video avatars and prerecorded video in level two testing.

Caps at B for the same reason as every other proofing vendor in the index, seven of them so far: external testing attests that someone else measured the model and does nothing to help the buying institution validate it. No false accept or false reject rates are published, no model documentation, versioning or drift monitoring is described, and the ceiling is a property of the category rather than a failing of this vendor.

Clears the A bar on a named customer with a quantified outcome attributed to a named executive: the chief marketing officer of Crocobet states that pass rate rose seventy four percent and average onboarding time fell twelvefold after integrating the interfaces.

Four further named executives are quoted, at the insurer Aldagi, the telecom operator Cellfie, an operations director and a World Bank land administration programme manager, alongside a wall of about fourteen named logos and coverage in the Financial Times.

The caveat to carry: the one quantified result belongs to a gaming operator rather than a financial institution, and the platform level figures beside it (ninety eight percent conversion, twelve hundred and sixty percent return on investment, a hundredfold faster activation) are self reported and attach to nobody.

Silent on the question the index treats as answerable and cheap: nothing states whether customer submitted identity documents, selfies or face images are used to train or improve the vendor's models, and no data separation, opt in or exclusion commitment appears anywhere in the published material. The access limitation and erasure commitments credited under privacy sit alongside this gap rather than filling it.

Against the reference set on this axis, where Mortgage Capital Trading excludes client data from the training corpus outright and AlphaSense binds its providers to zero retention, a biometrics vendor leaving the training question unanswered is a choice rather than an oversight.

Above the category norm on the question that matters most for a vendor holding identity documents and face images: it states that no sensitive data leaves its servers or is reached by employees without permission, and that its own staff review verification cases only when the customer raises a support ticket, which is a narrow purpose bound access commitment most of this tier leaves open.

A named data protection officer role is disclosed, retention is configurable and erasure is a product control. Held at B because retention periods are not published and the privacy commitments sit in a policy page and a pricing answer rather than in a structured privacy or trust centre.

Two audited certifications plus laboratory testing: a service organisation control type two report, information security management certification obtained in 2021, and iBeta level two presentation attack detection testing against the relevant international standard, with penetration test reports referenced. Held at B rather than the iDenfy A because nothing is documented to certificate number, examination period, accrediting body or trust portal level.

Two presentation faults recorded once rather than deducted twice: the badge row mixes the real certifications with a privacy statute and an electronic identification regulation, neither of which certifies anything, plus an analyst recognition badge; and the information security certification is absent from that row entirely, appearing only in a pricing page answer and a company timeline.

No licence and no supervised standing. Electronic identification regulation compliance is asserted as a badge rather than evidenced as registration, and procurement by two government ministries and a World Bank land administration programme is a customer relationship rather than a regulatory position. Open and cheap check banked for the next pass: the site footer carries a trust services statement hosted behind a document sharing link.

If that document shows registration as a trust service provider, this becomes the same finding as Authologic, whose regulatory grade moved from C to A on exactly that evidence, so the refusal here is a queued question rather than a closed one.

Nothing published. A face matching and liveness system operating across a hundred and ninety three countries and nine thousand document types offers no demographic performance breakdown, no fairness testing, no false reject rate by cohort and no governance framework. Presentation attack detection testing measures spoof resistance, not differential accuracy across skin tone, age or gender, and the vendor holds no facial recognition vendor test placement that would speak to the latter. Graded C rather than D because the silence is absence rather than a published claim that raises the concern directly.

No recourse route for the person being verified. Nothing describes what happens to a legitimate applicant wrongly rejected by the automatic threshold, no appeal or human rereview right is offered to that person as opposed to the buying institution, and no statement allocates responsibility for a false reject between the vendor and its customer.

This makes the sixth consecutive identity proofing vendor in the index to take C on this axis, which is the strongest single piece of evidence behind the finding that the tier buys its high scores from certification bodies and publishes nothing it would owe to the individual.

No model providers, base models or third party biometric engines are named anywhere, and the models are presented as the vendor's own. Amazon Web Services is disclosed as infrastructure only. Follows the standing pattern that vendors which build rather than license can stay silent, and the absence is total rather than partial.

Integration surface is documented and wide: representational state transfer application programming interface, web iframe and redirect, mobile software development kits for iOS, Android, Flutter and React Native, a no code workflow builder, single sign on with security assertion markup language, session transfer by quick response code, link or short message, a form fields interface, media download by interface and a sandbox account, with public documentation. No named core banking or policy administration connectors are published, which is the gap between this and an A in the category.

Public, private and hybrid cloud, hosted and on premises are all offered, with on premises and flexible data residency named as features of the top tier, plus multi cloud data backup, configurable data retention and a data erasure control as priced line items. Processing runs on Amazon Web Services across multiple geographic regions chosen to keep data inside the customer's required boundary. Held at B because no specific regions or countries are enumerated and the residency answer routes to a sales conversation.

Two tiers carry published unit prices with the terms around them: Essentials at forty five cents per verification with a hundred and fifty dollar monthly minimum including three hundred and fifty verifications, Advanced from twenty eight cents with a five hundred and twenty five dollar minimum including twelve hundred, and a third tier quoted. Beneath them a comparison grid of roughly sixty line items across three tiers marks which capabilities are included and which are metered extras.

Volume discounts are stated to exist and to be available to everyone, and the only additional charge is disclosed explicitly as value added tax, with no setup fees and no lock in. Short of the ComplyCube reference bar, which prices about twenty individual services at two tiers, but well above the category norm.

Broad by institution type and narrow by geography. Named financial buyers span retail banks (Bank of Georgia, TBC Bank, ProCredit Bank, Credit Agricole, Liberty), a digital bank (Space), an insurer (Aldagi), a Ukrainian payment institution (NovaPay) and a Lithuanian electronic money institution (Paysera), alongside telecom, gaming, healthcare and two Georgian government ministries.

More than one hundred enterprise and government organisations are claimed, up from over sixty reported in 2022, with document coverage across a hundred and ninety three countries. The concentration is the Caucasus, Ukraine, the Baltics and Central Asia rather than the major financial centres, which is why this is not an A.