IDfy

Models do the work that cannot be looked up: reading identity documents of variable quality, matching faces, judging liveness, detecting synthetic and manipulated media, and scoring device and velocity signals for fraud. A large share of the platform is not modelling at all, since verification in this market runs substantially through direct queries to national identity, tax, company and enterprise registries and credit bureaus, and parts of the background check business involve human investigation of court and employment records over days. Apply the removal test and a substantial registry integration and investigation business remains.

Human involvement here is partly structural rather than optional. Video based customer identification, a regulated onboarding route in this market, requires a trained officer to conduct a live session, and the background check business depends on human investigators pursuing court and employment records over hours or days rather than returning an instant verdict.

Customers configure their own flows through no code workflows alongside programmatic interfaces, so thresholds belong to the institution. What is not described is the review surface for automated checks: no case management, escalation path or reconsideration route for a rejected applicant was located.

Operational transparency is reasonable at the interface level, with documented response behaviour and realistic expectations set about which checks return in seconds and which take days, which is more honest than platforms implying everything is instant. The model layer is undocumented.

No accuracy, false acceptance or false rejection rates are published for document reading, face matching or liveness, no evaluation methodology or independent benchmark participation was located, and there is no model documentation or stated support for a customer's own validation.

Volume is the strongest evidence and it is stated consistently in two forms that reconcile, around two million verifications a day and more than sixty million a month, which is genuine operating scale rather than a coverage claim. Sector reach spans banking, non banking lenders, insurance, telecommunications, gaming, gig platforms and e-commerce, and a listed credit bureau is a strategic investor, meaning a data industry incumbent ran its own diligence.

Two cautions belong on the record: client counts differ materially between sources, appearing as more than 1,500 in one and around 600 enterprise clients in another, and no financial institution is named as a customer with a measured outcome.

The company publishes on synthetic identity and deepfake threats and names detection of manipulated media as a capability, which shows the problem is being tracked rather than ignored, and the completed security attestation supports the operational side. What is missing is validation and boundary. No independent presentation attack certification was located, which is the standardised test of the liveness capability being marketed. No model provenance is disclosed, and the fraud intelligence layer built on device fingerprinting and velocity signals implies cross client observation with no stated boundary.

The personal data footprint is among the widest in this index, covering national identity numbers, tax identifiers, bank account details, facial images and liveness captures, credit bureau records, and criminal and court histories, with the national identity system in particular governed by statute restricting who may perform authentication and how records may be retained. India's data protection regime and central bank localisation expectations for payment data both apply.

A service organisation control type two attestation covers confidentiality and privacy criteria, which is real assurance. No published privacy framework, retention schedule, localisation statement or subprocessor list was located.

A service organisation control type two attestation has been completed and announced publicly, described as following an extensive independent audit covering confidentiality and integrity of customer data. That is a finished audit with a named standard rather than an unspecified claim of maintaining certifications, and it places this ahead of most of the identity cluster in this index.

What is absent is the surrounding surface: no trust centre, no report request path, no stated audit period or scope, and no second framework such as an international information security standard or a local equivalent.

IDfy supplies technology and holds no financial licence, the expected posture, and its regulatory grounding is unusually concrete because the local regime is prescriptive. Central bank customer identification directions specify what onboarding must contain, video based identification is a defined regulated procedure, and authentication against the national identity system is a gated arrangement available only to approved entities, which is a formal admission rather than an integration choice. Business verification maps onto company, tax and enterprise registration requirements and beneficial ownership obligations for anti money laundering work.

Two exposures apply and the second is specific to this market. Face matching and liveness vary by skin tone, age and capture quality, and this platform operates where document condition and camera quality differ enormously across the population it serves.

More pointed is court record searching, where common names, transliteration between scripts and inconsistent record keeping make false matches a structural feature rather than an edge case, and a wrongly matched criminal record can cost someone a job, a loan or an account. No demographic accuracy, false match rate or correction methodology was located.

The consequences of an error here reach further than in most of this category, because the platform decides not only whether someone opens an account but whether a background check clears them for work or a loan. A false criminal record match, a failed face match or a mismatched identity record can cost a person employment, credit and banking access at once, and that person is not the customer, is rarely told which check failed and has no described route to see the underlying record or have it corrected. No accuracy guarantee, remediation commitment or correction process was located.

Data provenance is described more openly than most vendors manage, naming the categories of source a check draws on including national identity authentication, tax and company registries, small enterprise registration, bank account verification, credit bureaus and district and high court records, so a buyer can see which authorities stand behind a result.

The model side is closed: no providers are named for document reading, face matching, liveness or deepfake detection, several of which are commonly licensed rather than built in this market, and no subprocessor list is published.

The integration achievement here is national rather than enterprise: connecting into identity, tax, company, small enterprise and bank account infrastructure, plus credit bureaus and court record systems, each with its own access rules and reliability, is the hard and unglamorous part of operating in this market and is what a new entrant cannot replicate quickly. Delivery is dual, through programmatic interfaces and no code workflows so teams without engineering capacity can deploy. What was not located is enterprise depth: no named core banking or lending platform partners, no public developer documentation and no status page.

Delivery is cloud hosted across India, Southeast Asia and the Middle East. Residency is not a preference in this market but a requirement in places, since the central bank mandates domestic storage for payment system data and the national identity framework constrains where authentication data may be held, so a buyer would expect the vendor to state its position plainly. Nothing published identifies hosting regions, localisation arrangements, cross border transfer mechanisms for its Southeast Asian and Middle Eastern operations, or subprocessors.

No rates, tiers, billing unit or minimum were located on the company's own material. Third party guides discuss pricing and service level expectations for Indian buyers, which indicates the information circulates in the market, but it does not come from the vendor and cannot be relied on. The unit question matters at this volume, since a platform processing two million verifications daily is almost certainly priced per check with steep volume banding that a buyer cannot model from outside.

Financial coverage is real and locally specific, spanning banks, non banking financial companies, insurers and fintech lenders, and non banking lenders are a distinct regulated institution type in this market that a generic platform would not address separately. Business verification covers company, director, tax registration, small enterprise and proprietorship checks with beneficial ownership identification. The boundary is geographic: operations run across India, Southeast Asia and the Middle East with no European or North American coverage, so this is a regional platform rather than a global one.