SERPRO & Datavalid: the official source to validate identities against Brazil’s government databases

Key takeaways (TL;DR)
 

SERPRO is Brazil’s federal IT company, and Datavalid is its real-time identity verification service that queries official sources.

Datavalid blends biographic, document, and biometric (face) signals to raise onboarding and authentication accuracy.

Didit integrates Datavalid into automated workflows with audit trails and evidence aligned with the LGPD.

The outcome: less fraud and less friction, with rapid deployment and full control of thresholds and costs.

Brazil faces one of the world’s highest identity-fraud pressures: there’s an attempted scam every 2.2 seconds. To operate safely and comply with the LGPD (Lei Geral de Proteção de Dados), companies need to verify customer identities against official sources as part of a more robust verification strategy. In this context, SERPRO, the federal IT company founded in 1964, offers Datavalid, a service that validates data and face biometrics in real time against government records.

What do companies gain by integrating this service? An extra security layer during new-user onboarding and a reduction in impersonation and identity-theft risks. But these checks alone aren’t enough—they require a broader framework to truly reduce fraud.

This article explains how Datavalid works, the verification types you can run, and how Didit integrates these government-database queries to cut fraud, increase flexibility, and ensure traceability and compliance for teams and startups operating in Brazil.

What is SERPRO and why it’s Brazil’s identity-verification standard

SERPRO (Serviço Federal de Processamento de Dados) is Brazil’s federal government technology company. Founded in 1964 to modernize public administration, its current focus is enabling digital identity and identity verification at national scale to reduce fraud and accelerate critical onboarding and authentication flows.

Fighting fraud: high pressure and public-private convergence

Brazil’s digital market faces heavy fraud pressure. With nearly 40% of Brazilians affected by some scam in 2024, traditional approaches (manual reviews with little automation) fall short.

For example, see fraud in Brazilian banking and payments. After the explosion of Pix—the instant-payments system developed by the Central Bank of Brazil—scams using the platform grew sharply, pushing regulators to require stronger controls during onboarding and authentication.

Datavalid, the keystone in a state-backed layer

Within SERPRO’s portfolio, Datavalid is the standardized API verification service that queries official records in real time. It returns:

• Face similarity (biometric match).
• Biographic consistency (field-by-field validation).
• Document verification (document authenticity and coherence).

Why has it become a must-have standard for verifying users online in Brazil?

• Authoritative source. Checks are run against government records—no copies, no intermediaries.
• Regulatory alignment. Helps meet KYC/AML requirements with confidence.
• Continuous fraud evolution. Combines biographic, document, and biometric signals to harden processes.

Datavalid verification modes: 1×1, 1×N, and 2×2

• 1×1 verification. Comparison against a single reference. It may be biometric (face), biographic (CPF, name, date), or document-based (numbers/series, document data).
• 1×N verification. Search across a wider database to identify or detect recurrences/collisions. In practice, it’s primarily facial biometrics to stop multi-account abuse.
• 2×2 verification. Dual validation that combines two independent 1×1 checks (e.g., biographic + facial biometrics) so you don’t rely on a single indicator—especially for high-risk operations.

CPF: the key identifier and how to validate it

The CPF (Cadastro de Pessoas Físicas) is Brazil’s most common tax ID and a critical field in user identity verification. In a biographic 1×1 scenario, the CPF and associated data (e.g., name and date of birth) are matched against official records to check field-by-field consistency.

For higher-risk operations, this biographic validation is combined with biometric verification, raising certainty that the CPF actually belongs to the person completing onboarding.

Regulatory framework in Brazil for identity verification with SERPRO/Datavalid

Identity verification in Brazil must align with the LGPD. When a company validates users and includes Datavalid in its flow, processing relies on an appropriate legal basis. The goal is to prevent fraud and ensure security in the relationship, checking biographic, document, and biometric (face) data against official sources in real time.

Principles to meet (LGPD)

• Purpose & minimization. Request and use only what’s needed for KYC/fraud prevention.
• Transparency & rights. Clear privacy notice and enable data-subject rights.
• Security & governance. Technical and organizational measures (encryption, access control, monitoring, segregation).
• Accountability. Documented policies, processes, and decisions.

Datavalid-specific best practices

• Evaluate providers that correctly include government checks.
• Combine signals (biographic, document, and biometric) when risk warrants it.
• Apply 2×2 verifications for sensitive operations.
• Configure thresholds per use case and tune them with real-world data.
• Continuously review anti-fraud performance.

Note: This section is informational and not legal advice. Consult your legal and privacy teams.

Didit + SERPRO: native integration to reduce fraud

Didit is the verification platform more and more Brazilian companies choose to fight fraud. It integrates government-database checks via Datavalid, so you can orchestrate fully automated verification flows—document checks, face biometrics, and AML screening—in just a few steps. This trims manual review dependency, reduces fraud, and speeds up onboarding for legitimate users with stronger decisions.

What sets Didit apart from common Brazilian identity-verification platforms? Its fraud-fighting capability. Unlike Idwall, which requires many manual reviews, or Unico’s risk score, Didit delivers a truly end-to-end platform tailored to Brazil’s top market demand: cutting fraud. How? By combining multiple features that, together, create an autopilot shield for your business.

Brazilian companies’ most in-demand anti-fraud features include:

• Document verification. Authenticity and coherence checks; tamper detection; data matching against official sources.
• Face biometrics (1×1 Face Match & Liveness Detection). Confirms the document belongs to the user and that the user is physically present.
• AML screening. Sanctions, PEPs, and adverse-media checks.
• Government-database checks. Integration that adds an extra security layer to your verification process.

All of this is reinforced by ongoing analysis of fraud patterns in Brazil, so you can respond before they impact your business.

Didit + SERPRO verification flow

1. Document & CPF capture. During document verification, Didit extracts the CPF field and validates biographic consistency (1×1) against the official source.
2. Biometrics. 1×1 Face Match captures the document image and the user’s live face to confirm they’re the same person. Liveness Detection then confirms real presence at that moment.
3. SERPRO query in 2×2 mode. Didit orchestrates two signals: (a) biographic (CPF + name/date) and (b) biometric (1×1 face match) against Datavalid.
4. Risk-based decision rules. If both signals pass the configured threshold, verification is auto-approved. If one lands in a gray zone, you can request extra evidence or trigger 1×N (when applicable) before deciding.
5. Evidence & audit. The Didit report logs field-level results, face-similarity, and the final decision, with full traceability for audit and compliance.

Benefits of Didit for compliance teams and startups operating in Brazil

• Automated processes. Didit is a fully automated identity-verification platform. Customize your flow with thresholds to auto-approve or auto-reject users—or route to manual review if needed.
• Fraud reduction. Brazilian companies integrating Didit report significant drops in fraud and manual reviews.
• Flexibility & time-to-market. Launch verification in minutes—cut typical integration times, no sales calls or slowdowns that can hurt conversion.
• Cost savings. We offer Brazil’s first and only unlimited free KYC plan. It also helps reduce costs versus other providers.
• Price transparency. Unlike other platforms in Brazil, Didit offers fully transparent pricing with prepaid credits that never expire.

For technical teams: Database Validation APIs

Didit exposes Database Validation APIs so you can integrate Datavalid checks directly into your systems, both 1×1 (biographic/biometric) and 2×2 (combined).

Documentation:

• API overview: https://docs.didit.me/reference/database-validation
• Technical reference: https://docs.didit.me/reference/database-validation-api