Skip to main content
Didit Raises $7.5M to Build the Infrastructure for Identity and Fraud
Didit
Biometric payments · PSD3 SCA

Pay with your face.

One-time $0.33 KYC enrolment binds the customer to a face template. Every payment after that is a $0.05 passive-liveness + 1:1 match, sub-2-second at the till. PSD3 SCA inherence-factor compliant. 500 verifications free every month.

Start freeRead the docs
Backed by
Y CombinatorRobinhood Ventures
GBTC Finance
Bondex
Crnogorski Telekom
UCSF Neuroscape
Shiply
Adelantos

Trusted by 2,000+ organizations worldwide.

Didit biometric payments workflow showing PSD3 SCA-compliant face-pay authentication with passive liveness at a point-of-sale terminal.

POS · SoftPOS · Vending · Wallet checkout

Skip the card. Walk up. Pay.

Card-and-PIN takes 4–7 seconds and breaks when the card is forgotten. Face-pay takes ~1 second, works without a phone or a card, and ships with the PSD3 SCA inherence factor baked in. Drop-in addition to your existing POS, keep card-and-PIN for the customers who want it.

How it works

From card-and-PIN to face-at-the-till in four steps.

  1. Step 01

    Enrol the customer once

    One $0.33 KYC bundle session, ID Verification, Passive Liveness, Face Match 1:1. The encrypted face template is bound to your vendor_data and stored under a separate Customer Master Key. Single onboarding, every future payment is just the match.

  2. Step 02

    Wire the POS to Face Search 1:N

    Every terminal hits POST /v3/face-search/ with the captured camera frame. The till runs a sub-2-second 1:N match against the enrolled payer roster, no customer-typed username, no separate identify step. Pair with Passive Liveness on unattended kiosks where no cashier verifies the human is real.

  3. Step 03

    Customer walks up and pays

    Single-frame capture, sub-2-second inference, signed approve/decline at the terminal. No phone, no card, no PIN. Add Device & IP Analysis for the PSD3 possession factor on amounts above the contactless limit. Fallback to card-and-PIN any time the user prefers, the two flows live side by side.

  4. Step 04

    Audit + monitor

    Every auth fires a signed webhook with the match result + similarity score. Transaction Monitoring ($0.02 per transaction) runs the velocity + fraud rules on top, and Ongoing AML ($0.07/user/year) keeps every customer screened post-onboarding.

Built for face-pay · Priced like infrastructure

$0.33 enrolment. $0.05 per payment after.

Biometric payment is a composition, one heavy enrolment per customer, one cheap auth per transaction. Compose the modules the buyer needs in the Workflow Builder, or call them inline through the API.
Read the docsGet an API key
01 · Enrolment KYC

One $0.33 session binds a face to a payer.

ID Verification + Passive Liveness + Face Match 1:1 + Device & IP Analysis run in a single /v3/session/ call. The portrait becomes the customer's payment template, encrypted under its own Customer Master Key.
Free KYC module
02 · Face Search 1:N at the till

The customer walks up. The till finds them.

Face-pay is an identification problem, not an authentication one, the customer doesn't type a username first. POST /v3/face-search/ runs a sub-2-second 1:N match against the enrolled payer roster. Pair with Passive Liveness on unattended kiosks and self-serve terminals where no cashier verifies the human is real.
Face Search 1:N
03 · PSD3 SCA inherence + possession

Two SCA factors. One biometric prompt.

Pair the face match (inherence) with Device & IP Analysis (possession) in the same call. Strong Customer Authentication compliant under PSD3 + PSR for payment initiations above the contactless limit.
PSD3 SCA workflow
04 · Dynamic linking on the amount

Amount + payee echo on every signed webhook.

Pass metadata.amount + metadata.payee on the session. The signed webhook echoes both values, so the customer's consent is cryptographically bound to the specific transaction, PSD3-compliant dynamic linking, no separate flow needed.
Workflow Orchestrator
05 · Post-payment monitoring

Transaction Monitoring + Ongoing AML, optional.

Layer Transaction Monitoring ($0.02 per transaction) and Ongoing AML ($0.07 per user per year) for the regulated end of the funnel, refund risk, velocity, sanctions re-screen. Same /v3/ contract, no extra integration.
Transaction Monitoring
06 · Card-and-PIN fallback

Face-pay adds. Nothing breaks.

Customers opt in once. Anyone who doesn't enrol keeps the card-and-PIN flow you already have. Same terminal, same chargeback economics, same Visa/Mastercard rails, face-pay is an additive factor, not a replacement.
Talk to us
Compliant by design

Open a new country in one click. We do the hard work.

We open the local subsidiaries, secure the licenses, run the penetration tests, earn the certifications, and align with every new regulation. To ship verifications in a new country, flip a toggle. 220+ countries live, audited and pen-tested every quarter, the only identity provider an EU member-state government has formally called safer than in-person verification.
Read the security & compliance dossier
EU financial sandbox
Tesoro · SEPBLAC · BdE
ISO/IEC 27001
Information security · 2026
SOC 2 · Type I
AICPA · 2026
iBeta Level 1 PAD
NIST / NIAP · 2026
GDPR
EU 2016/679
DORA
EU 2022/2554
MiCA
EU 2023/1114
AMLD6 · eIDAS 2.0
EU-aligned by design

Proof numbers

Proof numbers
  • $0.00
    One-time KYC enrolment per customer.
  • $0.00
    Per face-pay auth at the terminal.
  • sub-2s
    p99 inference end-to-end at the POS.
  • 0
    Free verifications every month, forever.
FAQ

Common questions

What is Didit?

Didit is infrastructure for identity and fraud, the platform we wished existed when we were building products ourselves: open, flexible, and developer-friendly, so it works as a real part of your stack instead of a black box you integrate around.

One API covers verifying people (KYC, know your customer), verifying businesses (KYB, know your business), screening crypto wallets (KYT, know your transaction), and monitoring transactions in real time, on a stack built to be:

  • Fast, sub-2-second p99 on every session
  • Reliable, in production with 1,500+ companies across 220+ countries
  • Secure, SOC 2 Type 1, ISO 27001, GDPR-native, and formally attested by Spain's financial regulator as safer than verifying someone in person

The footprint underneath: 14,000+ document types in 48+ languages, 1,000+ data sources, and 200+ fraud signals on every session.

How fast is a face-pay auth at the POS?
Sub-2-second end-to-end inference per session, passive liveness + 1:1 face match against the bound template, returns approve/decline before the customer steps away from the terminal.
Is biometric payment legal in the EU under PSD3?
Yes when consent and lawful basis (Article 9 GDPR) are explicit and the template is stored under your control. Didit ships the consent UX, the audit trail, and the PSD3 SCA-compliant binding (inherence factor via passive liveness + face match, possession via Device & IP Analysis). The stack is iBeta Level 1 PAD certified and validated by Spain's Tesoro / Banco de España / SEPBLAC as safer than verifying someone in person.
How does a customer bind their face the first time?
One ID Verification + Passive Liveness + Face Match 1:1 session on the customer's phone or at the kiosk. We extract a template, encrypt it under a separate Customer Master Key, and return the template id to your system. From that moment, every subsequent terminal auth is just the 1:1 match against that template, no document, no app needed.
Can the same face template be reused across terminals and brands?
Yes, the bound template is yours, scoped to your application. Across terminals on the same account, the customer auths with one face. Across separate brands, Reusable Identity lets the user opt in to share their verified template with a trusted partner. eIDAS 2.0 aligned, user-owned credential.
What hardware does the gate camera need?
Any commercial-grade RGB camera at ≥720p with reasonable light. Our SDK runs inference cloud-side, so no specialised on-prem appliance is required. Existing POS terminals integrate via a REST webhook to call /v3/session/ or /v3/face-match/.
Compliance, what certifications cover biometric payments?
PCI DSS 4.0 for card-data adjacency, PSD3 + PSR for strong customer authentication, iBeta Level 1 PAD for spoof resistance, eIDAS 2.0 for cross-border identity wallet alignment, GDPR + UK GDPR for biometric data handling, SOC 2 Type 1 and ISO/IEC 27001:2022 for the platform stack. Full memo + every certificate at /security-compliance.
Where does the biometric template live and how is it protected?

Production data is processed and stored in the European Union by default on Amazon Web Services. Enterprise contracts can request alternative regions for jurisdictions whose regulators require it.

Encryption everywhere. AES-256 at rest, TLS 1.3 in transit, biometric data encrypted under a separate Customer Master Key. Retention is yours to control, between 30 days and 10 years per application, and you can delete any individual session at any time from the dashboard or the API.

What happens if a face match fails at the terminal?
Every session lands on one of seven clear statuses. Approved lets the user pay. Declined lets you fall back to card + PIN or step up to a fresh ID re-check (resubmittable without re-running the whole flow). In Review routes the case to the dashboard for compliance. A signed webhook fires on every status change so your POS state stays in sync.
How much does biometric payment auth cost per transaction?
$0.05 per face-pay auth (passive liveness + 1:1 match) on top of a one-time $0.33 KYC enrolment per customer. 500 verifications free every month, most pilots stay inside the free tier. No minimums, no annual commitment, no per-terminal pricing.
Can I run it side-by-side with my existing card-and-PIN flow?
Yes. Biometric payment is an additive factor, the customer who opts in walks up and pays with their face, the customer who doesn't keeps the card-and-PIN flow you already have. Same POS terminal, same dashboard, same billing.
How fast can I integrate biometric payments?

60 seconds to a sandbox account at business.didit.me, no credit card.

5 minutes to a working enrolment + auth via Claude Code, Cursor, or any coding agent through our MCP server.

A weekend to a production-ready POS integration with signed-webhook verification, retries, and a fallback flow to card-and-PIN when the user is declined. Step-by-step guide at docs.didit.me/integration/integration-prompt.

Related

Related modules + workflows

Infrastructure for identity and fraud.

One API for KYC, KYB, Transaction Monitoring, and Wallet Screening. Integrate in 5 minutes.

Start freeTalk to us
Ask an AI to summarise this page