Skip to main content
Didit Yakusanya $7.5M Kujenga Miundombinu ya Utambulisho na Udanganyifu
Didit
Uaminifu

Tunabeba mzigo wa kufuata sheria. Zindua ukaguzi wa utambulisho kwa mbofyo mmoja

Tunashughulikia leseni, kampuni tanzu, na ukaguzi ili timu yako ya kufuata sheria na hatari iweze kusonga haraka. Washa swichi na uzindue katika nchi yoyote kwa kufuata sheria, SOC 2 Type 1, ISO/IEC 27001, na uthibitisho wa serikali ya Tesoro EU zimejumuishwa.

Pata demoSoma ripoti ya mdhibiti

Kwa namba

Kwa namba
  • 0%
    Muda halisi wa kufanya kazi katika miezi 12 iliyopita. Imerekodiwa moja kwa moja kwenye status.didit.me dhidi ya SLO (Service Level Objective) ya 99.99%.
  • 0
    Ukiukaji mkubwa tangu Didit ilipozinduliwa. Imejaribiwa kikamilifu katika uzalishaji tangu 2023.
  • Mamilioni
    Watu wanathibitishwa kila mwezi kwenye mfumo wa uzalishaji.
  • Imethibitishwa
    Inatii sheria kila mahali Didit inapoendesha shughuli zake, SOC 2 Type 1, ISO/IEC 27001, iBeta Level 1 PAD, na uthibitisho wa mdhibiti wa Uhispania.
Rekodi ya umma

Wadhibiti wanasema Didit ni salama zaidi kuliko uthibitishaji wa ana kwa ana.

Uhispania ilijaribu kwa kina usomaji wa chip ya Near-Field Communication (NFC) ya Didit pamoja na uhai hai na kuiweka kwenye rekodi ya umma kama salama angalau kama kukagua kitambulisho ana kwa ana. Hakuna mtoa huduma mwingine wa utambulisho anayeshikilia uthibitisho huu.
Inasimamiwa na
  • Tesoro Público, Hazina ya Uhispania
  • Banco de España, Benki Kuu ya Uhispania
  • SEPBLAC, Kitengo cha ujasusi wa kifedha cha Uhispania
  • CNMV, Comisión Nacional del Mercado de Valores
Soma ripoti kamili
“Uthibitishaji wa NFC + uhai hai wa Didit unatoa usalama sawa au mkubwa kuliko uthibitishaji wa ana kwa ana.”
Hazina ya Uhispania, Informe de Conclusiones DIDIT, Februari 2026

Novemba 2024, Julai 2025 · Sandbox financiero (Sheria 7/2020), kundi la 4 · inasimamiwa na Tesoro Público, Banco de España, SEPBLAC, na CNMV.

Uhandisi wa udanganyifu

Timu maalum ya udanganyifu. Mifumo, ufuatiliaji, kuzuia.

Timu inayozingatia tu udanganyifu hujenga, hufunza, na kufuatilia mifumo ya kugundua nyuma ya kila kipindi cha Didit, deepfakes, injection attacks, forgeries, synthetic identities, money mules. Shambulio jipya porini? Ishara mpya wiki hiyo. Watumiaji halali hawahisi kamwe.

  • Models, yaliyojengwa na kufunzwa upya ndani.

    Liveness, deepfake detection, document classifiers, face match, injection-attack detection, behavioural risk, kila model huishi katika mfumo wetu wa mafunzo na utoaji huduma.

  • Ufuatiliaji, kila session, kila saa.

    Traffic ya uzalishaji hulisha foleni ya ukaguzi wa wakati halisi. Drift, false-positive rate, mabadiliko ya attack-pattern na ubora wa signal kwa kila nchi hufuatiliwa mfululizo; vizingiti hurekebishwa upya bila mabadiliko ya code ya mteja.

  • Kuzuia, inline, isiyoonekana kwa mtumiaji.

    Kila model huunganishwa inline kwenye session. Sub-2-second p99 inference, hakuna round-trip ya ziada, hakuna tap ya ziada. Mtumiaji halali humaliza uthibitishaji katika flow ileile; mshambuliaji pekee ndiye huona njia tofauti.

Vyeti

Kila dai lina hati nyuma yake.

Uthibitisho sita wa nje unaohusu usalama, faragha, kuzuia udanganyifu wa kibayometriki, utoshelevu wa udhibiti, na utambuzi wa serikali. Kila kadi inatoa hati halisi, si PDF ya masoko.
Beji ya uthibitisho ya SOC 2 Aina ya 1New
AICPA · 2026-04-09

SOC 2 Aina ya 1

Ukaguzi huru wa udhibiti wetu wa usalama, upatikanaji, na usiri, uliotolewa na ATOM mnamo Aprili 2026. Ukaguzi wa Aina ya 2 unaendelea.

Pata memo
Cheti cha ISO 27001 kilichotolewa na Bureau Veritas
ES144068 · Bureau Veritas

ISO/IEC 27001:2022

Inathibitisha kuwa usimamizi wetu wa usalama wa habari unashughulikia uthibitishaji wa Didit kuanzia mwanzo hadi mwisho. Imetolewa na Bureau Veritas, halali hadi Juni 2027.

Tazama cheti
Beji ya iBeta Level 1 PAD inayotii
ISO/IEC 30107-3 · NIST/NVLAP

iBeta Level 1 PAD

Jaribio la kuzuia udanganyifu wa kibayometriki, majaribio 360 katika kategoria sita za mashambulizi, hakuna hata moja iliyopita. Ilifanywa katika maabara ya NVLAP iliyoidhinishwa na NIST 200962.

Tazama ripoti
Alama ya maneno ya Tesoro Público, Hazina ya Uhispania
Uhispania · CNMV · SEPBLAC · BdE

Uthibitisho wa Tesoro sandbox

Sandbox ya mwaka mzima iliyofanywa na wadhibiti wanne wa kifedha wa Uhispania ilihitimisha kuwa uthibitishaji wa mbali wa Didit ni salama angalau kama ukaguzi wa vitambulisho vya ana kwa ana. Hakuna mtoa huduma mwingine wa utambulisho anayeshikilia hii.

Soma hitimisho
Beji ya GDPR Tayari
EU 2016/679 · DPA · TOMs

GDPR Kifungu cha 32

Uzingatiaji kamili wa Kanuni Kuu ya Ulinzi wa Data (GDPR) kama Mchakataji Data. Mkataba wa Uchakataji Data na Hatua za Kiufundi na Kiutendaji zinapatikana kwa ombi.

Soma msimamo wa uzingatiaji
Beji ya uzingatiaji wa EBA / MiCA
EBA/GL/2022/15 · MiCA

Uzingatiaji wa EBA / MiCA

Maoni huru ya kisheria: Usajili wa mbali wa Didit unakidhi Miongozo ya Mamlaka ya Benki ya Ulaya kuhusu usajili wa wateja wa mbali (EBA/GL/2022/15) na inaoana na Kitabu cha Kanuni Moja cha Kupambana na Utakatishaji Fedha (AML) cha EU na kanuni ya Masoko katika Mali za Crypto (MiCA).

Pata memo
Ulinzi wa data

Tunachohifadhi, tunapohifadhi, na tunachohifadhi kwa muda gani.

Wewe ndiye mmiliki wa data; Didit huichakata kwa niaba yako. Chini ya GDPR (Kanuni Kuu ya Ulinzi wa Data) wewe ndiye Mdhibiti wa Data na Didit ndiye Mchakataji Data. Jukwaa linakuja na vidhibiti vya GDPR Kifungu cha 32 na sheria za ulinzi wa data za ndani tayari zimeunganishwa.

  • Usimbaji fiche ukiwa umepumzika — AES-256.

    Kila kipindi kimesimbwa fiche kikiwa kimepumzika kwa funguo za AES (Advanced Encryption Standard) za biti 256. Funguo hazigusi kamwe msimbo wetu wa programu, zinakaa kwenye AWS KMS (Key Management Service), zikiwa na funguo tofauti kwa sandbox na production.

  • Usimbaji fiche wakati wa usafirishaji — TLS 1.3.

    Kila API call, webhook, na kipindi cha Business Console kimesimbwa fiche kupitia TLS (Transport Layer Security) 1.3 kwa sheria kali za cipher. Itifaki za zamani haziwezi kurudi nyuma; HSTS (HTTP Strict Transport Security) inatekelezwa kwenye tovuti nzima.

  • Makazi ya data — EU kwa chaguo-msingi.

    Vipindi vinachakatwa na kuhifadhiwa katika Umoja wa Ulaya kwa chaguo-msingi kwenye AWS. Biashara inaweza kuwezesha makazi ndani ya nchi, kulingana na upatikanaji, ili timu katika soko lolote ziendeshe Didit kwa kufuata sheria.

  • Uhifadhi — Mwezi 1 hadi miaka 10.

    Chagua muda ambao Didit huhifadhi kila kipindi, kutoka mwezi mmoja hadi miaka kumi, kwa kila programu kwenye Business Console. Usambazaji wa alama ndogo unaweza kufuta kipindi mara tu webhook inapoingia.

  • Ushughulikiaji wa biometriska — Upunguzaji wa data.

    Unachagua ni data gani hasa Didit inakusanya, kila kitu kingine huachwa. Kwa chaguo-msingi, ni templates za biometriska na metadata pekee zinazohifadhiwa; selfies halisi na video ya uhai hufutwa mara tu kipindi kinapofungwa.

  • Haki za mhusika wa data — Futa data kwa endpoint moja.

    DSAR kamili (Ombi la Ufikiaji wa Data ya Mhusika) na haki ya kufutwa kwa ombi kupitia API ya umma. Watumiaji wa mwisho hutuma DSARs kutoka programu ya Didit Identity; timu yako huyaanzisha kwa DELETE call moja kwenye sessions endpoint. Inatekelezwa kwenye kila replica, hakuna soft-delete, hakuna archive bucket.

FAQ

Maswali ya usalama, yamejibiwa.

Majibu yale yale tunayotuma kwa timu za usalama za enterprise. Kingine chochote, security@didit.me.
How secure is Didit?

Zero data breaches since Didit launched in 2023. Security is built into every layer of the platform.

  • Zero breaches, across millions of verifications and 1,500+ paying customers.
  • Everything is encrypted, both when data is stored and when it moves between systems. Encryption keys live in Amazon Web Services (AWS), separated so a sandbox cannot read production data.
  • Every request is checked. Every action is logged. No shared secrets across customers.
  • Independently audited, SOC 2 Type 1 (Type 2 in progress), ISO/IEC 27001:2022, and iBeta Level 1 Presentation Attack Detection (PAD) with 0% attack-success across 360 attempts.
  • Live public status page at status.didit.me, every incident, every post-mortem, no login required. 100% uptime over the last 6 months.
  • If anything happens, we tell you within hours, well inside the General Data Protection Regulation (GDPR) Article 33 reporting window. Enterprise gets a named engineer on call 24/7, with a dedicated Slack and WhatsApp channel.

Request the Trust Pack on this page, SOC 2 report, ISO certificate, iBeta report, Tesoro attestation, Data Processing Agreement (DPA), sub-processors list, sent back the same business day under a signed Non-Disclosure Agreement (NDA).

I have lots of verifications. Will Didit support my volume?

Yes. The infrastructure scales itself in real time and supports millions of verifications a day.

  • Scales automatically. When your traffic doubles overnight, the platform expands itself. No sales call, no capacity-plan rewrite, no warning needed.
  • Every check completes in under 2 seconds, even at peak load. The infrastructure is optimised for fast inference end to end.
  • 100% uptime over the last 6 months. Track it live at status.didit.me, no login required.
  • Battle-tested in production, 1,500+ paying customers across 220+ countries, in production since 2023.
  • Built for spike events, sports-betting kick-offs, marketplace launches, age-verification rollouts. The platform handles the spike without anyone at Didit having to lift a finger.
  • Enterprise contracts include written guarantees, a Service Level Agreement (SLA) on speed, uptime, and capacity, with billing credits if we miss.

Volume tiers on the pricing page kick in automatically as you grow, no contract change, no manual renegotiation.

What data does Didit store, and how much control do I have over it?

You choose, per workflow. Didit does not have a fixed list of what we keep. Your compliance team configures each app in the Business Console, and the workflow only collects and stores what you tell it to.

The Returned-data tab gives you a toggle for every category:

  • Identity (ID) document images and Machine-Readable Zone (MRZ) fields
  • Near-Field Communication (NFC) chip data
  • Extracted identity fields (name, date of birth, document number, expiry, address)
  • Biometric templates
  • Raw selfie and full liveness video
  • Device fingerprint, browser, operating system, platform
  • Internet Protocol (IP) geolocation, Virtual Private Network (VPN) / Tor signals
  • Document-location match coordinates
  • Anti-Money Laundering (AML) screening hits with sanctions, Politically Exposed Person (PEP), and adverse-media match details
  • Webhook payload, audit log, and per-session metadata

The exact list of toggles depends on the modules in your workflow, check them when you set the workflow up in the Business Console under Returned-data.

Who is the Data Controller and who is the Data Processor?

You are the Data Controller. Didit is the Data Processor. This is the General Data Protection Regulation (GDPR) Article 28 set-up most regulated buyers expect.

  • You decide why the data is collected, what fields are kept, how long they are retained, and who inside your team can act on them. The Data Processing Agreement (DPA) on this page is the contract that binds Didit to those instructions.
  • Didit processes the data on your behalf, running the verifications, the screening, the biometric checks, the document classification, the webhooks, under your DPA and under our own SOC 2, ISO/IEC 27001, and General Data Protection Regulation (GDPR) Article 32 controls.

We recommend you let Didit store and access the data on your behalf. Most of our customers do. Securing identity data at internet scale is a full-time job: hardened encryption, key rotation, intrusion detection, vulnerability management, certification renewals, regional residency, data-subject-rights tooling, breach notification. Didit's security and platform teams focus on it every day so your compliance and engineering teams do not have to. You retain full control through the Business Console, every retention rule, every Data Subject Access Request (DSAR), every delete is yours to trigger.

If your policy requires the data to live entirely in your own environment (your cloud account, your on-premise database), we support that too, Didit runs as a processor on a fetch-and-forget basis and your team owns retention end to end.

Where is data stored, and can I choose the region?

European Union by default. Specific region or in-country available on Enterprise.

The default deployment runs on Amazon Web Services (AWS) in EU. Data is encrypted at rest and in transit, with encryption keys held by AWS and separated per environment.

  • European Union (default), every account. Covers the General Data Protection Regulation (GDPR), Schrems II / European Union, United States Data Privacy Framework, and eIDAS 2.0.
  • Specific region (United States East, Asia-Pacific, etc.), Enterprise contracts, when your regulator requires it.
  • In-country residency (Brazil, India, etc.), Enterprise, subject to availability, for local laws like Brazil's Lei Geral de Proteção de Dados (LGPD) and India's Digital Personal Data Protection Act (DPDPA).

When data crosses a border, it is protected by the European Commission's 2021 Standard Contractual Clauses (SCCs). The matching Transfer Impact Assessment (TIA) ships with the Trust Pack on this page.

How long do you keep data, and how do I configure retention?

You set the retention window. From 1 month to 10 years, per app. Enforcement is automatic.

In the Business Console you set:

  • A global retention window, anywhere from 1 month (when you want Didit to keep nothing after your webhook fires) to 10 years (the Anti-Money Laundering Directive 6 (AMLD6) ceiling).
  • Per-data-category retention, biometric templates can outlive raw images; screening hits can outlive identity data; document-location match can be dropped entirely.
  • Automatic enforcement, every night, the platform deletes anything past its retention window across every copy. Every delete is recorded in the audit log.

If you want Didit to keep nothing after the verdict, call POST /v3/sessions/:session_id/delete/ from your webhook handler and the session is gone the moment your system records its own copy of the result, Didit never holds the data past the call. Full reference at docs.didit.me/sessions-api/delete-session.

How do you handle Data Subject Access Requests (DSARs), deletion, and portability?

One endpoint per right.

  • Right of access (Article 15) and right to data portability (Article 20), pull the full session payload at GET /v3/sessions/:session_id/decision/. Reference at docs.didit.me/sessions-api/retrieve-session.
  • Right to erasure (Article 17), POST /v3/sessions/:session_id/delete/ removes the session and every linked artifact. Reference at docs.didit.me/sessions-api/delete-session.
Which certifications and attestations do you hold?

Five external attestations on file. All packaged in the Trust Pack.

  • SOC 2 Type 1, Security, Availability, and Confidentiality, issued by ATOM in April 2026 under the American Institute of Certified Public Accountants (AICPA) Trust Services Criteria. SOC 2 Type 2 examination is in progress.
  • ISO/IEC 27001:2022, Information Security Management System, certified by Bureau Veritas (certificate ES144068, valid through 2027-06-03).
  • iBeta Level 1 Presentation Attack Detection (PAD), independent biometric anti-spoofing test, conducted under ISO/IEC 30107-3 at a National Institute of Standards and Technology (NIST)-accredited lab. 0 successful attacks across 360 attempts.
  • GDPR Article 32, Data Processing Agreement (DPA), sub-processor list, and Technical and Organisational Measures (TOMs), all public.
  • European Banking Authority (EBA) / Markets in Crypto-Assets (MiCA) memo, independent legal opinion that Didit satisfies the EBA Guidelines on remote customer onboarding (EBA/GL/2022/15) and the MiCA regulation.

Request the Trust Pack on this page and we send every report, certificate, and memo back the same business day under a signed Non-Disclosure Agreement (NDA).

What does the Spanish regulator attestation actually mean for me?

Mutual recognition across the European Union (EU), and a regulator-defensible audit trail.

Spain's Tesoro Público, Banco de España, SEPBLAC, and CNMV ran a year-long financial sandbox (November 2024 – July 2025) on Didit's Near-Field Communication (NFC) chip read plus active liveness onboarding flow. The official conclusions report, published on tesoro.es, finds Didit's remote verification meets or exceeds the security level of in-person identification under the Anti-Money Laundering Directive (AMLD).

For your compliance team this means:

  • AMLD6 mutual recognition, the attestation is portable across every other EU member state without re-certification.
  • eIDAS 2.0 alignment, Didit's NFC + liveness flow is on the public record as suitable for Qualified Electronic Signature (QES) onboarding.
  • Defensible audit trail, when your local Financial Intelligence Unit (FIU) reviews your onboarding, you point at the same report your EU peer regulators have signed off on.

Didit is the only identity-verification vendor with this attestation on the public record.

Can I ask Didit to obtain a specific license or certification?

Yes, and we are probably already working on it. Didit is actively pursuing 10+ certifications, licenses, and regulator approvals across markets and verticals at any given time: payment authorisations, crypto and Markets in Crypto-Assets (MiCA) registrations, Anti-Money Laundering (AML) supervisor approvals, eIDAS 2.0 Qualified Trust Service Provider (QTSP) status, regional Financial Intelligence Unit (FIU) reporting, and vertical-specific authorisations (iGaming, healthcare, banking).

If there is a license or certification your compliance team needs Didit to hold, email `security@didit.me`. Odds are it is already in our queue, and if it is not, your request bumps it up the list. We come back with:

  • Where the certification sits in our roadmap.
  • The expected timeline.
  • The scope (full coverage, a specific region, a specific module).

Miundombinu ya utambulisho na udanganyifu.

API moja kwa KYC, KYB, Ufuatiliaji wa Miamala, na Uchunguzi wa Wallet. Unganisha ndani ya dakika 5.

Anza bila malipoZungumza nasi
Uliza AI ifupishe ukurasa huu