Skip to main content
Didit Yakusanya $7.5M Kujenga Miundombinu ya Utambulisho na Udanganyifu
Didit
PSD3 · Uthibitishaji imara wa mteja

Vipengele viwili vya SCA. Gonga mara moja.

Uthibitishaji wa Kibayometriki ($0.10) pamoja na Uchambuzi wa Kifaa & IP ($0.03) hutoa vipengele viwili vya SCA vya kiwango cha PSD3 katika ombi moja. Inazuia hadaa. Mbadala rahisi wa nenosiri la mara moja la SMS.

Anza bureSoma nyaraka
Inaungwa mkono na
Y CombinatorRobinhood Ventures
GBTC Finance
Bondex
Crnogorski Telekom
UCSF Neuroscape
Shiply
Adelantos

Inaaminika na mashirika 2,000+ duniani kote.

Mchoro wa kufuata sheria wa kisanii, giza na usio dhahiri, paneli nne zinazoelea, zisizo na uwazi, za kioo cheusi katika mtazamo wa 3D kwenye turubai nyeusi kabisa, zikipitishwa na mstari wima wa Didit Blue unaong'aa na kuwekewa fremu na mabano manne ya skana yanayong'aa. Kila paneli ina motifu ndogo nyeupe isiyo dhahiri (mishororo ya alama za vidole, mviringo wa uso, silhouette ya simu, umbo la kufuli) inayowakilisha Uthibitishaji Imara wa Mteja wa kibayometriki.

Kwa nini SMS OTP inastaafu

Inazuia SIM-swap. Inazuia Phishing. $0.13 kwa uthibitishaji.

PSD3 inaondoa nenosiri la mara moja la SMS kama kipengele cha Uthibitishaji Imara wa Mteja. SCA ya Didit inayotumia biometriska inayofungamana na kifaa inazuia SIM-swap, hadaa ya wakati halisi, na kukatiza kwa SS7, kwa $0.13 kwa uthibitishaji, uamuzi wa chini ya sekunde mbili, tayari kwa dynamic-linking. Uthibitishaji 500 bila malipo kila mwezi.

Jinsi inavyofanya kazi

Kuanzia kujisajili hadi mtumiaji aliyethibitishwa kwa hatua nne.

  1. Hatua 01

    Unda mtiririko wa kazi

    Chagua ukaguzi unaotaka, ID, liveness, face match, vikwazo, anwani, umri, simu, barua pepe, maswali maalum. Ziburute kwenye mtiririko kwenye dashibodi, au tuma mtiririko huo huo kwenye API yetu. Panga masharti, endesha majaribio ya A/B, hakuna code inayohitajika.

  2. Hatua 02

    Unganisha

    Pachika moja kwa moja na SDK yetu ya Web, iOS, Android, React Native, au Flutter. Elekeza kwenye ukurasa uliopangishwa. Au tuma tu mtumiaji wako kiungo, kwa barua pepe, SMS, WhatsApp, popote. Chagua kinachofaa stack yako.

  3. Hatua 03

    Mtumiaji anapitia mtiririko

    Didit inasimamia kamera, ishara za mwanga, uhamishaji wa simu, na ufikiaji. Mtumiaji anapokuwa kwenye mtiririko, tunapima ishara 200+ za udanganyifu kwa wakati halisi na kuthibitisha kila sehemu dhidi ya vyanzo vya data vya kuaminika. Matokeo yanapatikana chini ya sekunde mbili.

  4. Hatua 04

    Unapokea matokeo

    Webhooks zilizotiwa saini za wakati halisi huweka database yako sawa mara tu mtumiaji anapoidhinishwa, kukataliwa, au kutumwa kwa ukaguzi. Piga API inapohitajika. Au fungua console kukagua kila session, kila ishara, na kudhibiti kesi kwa njia yako.

Imeundwa kwa SCA · Bei kama miundombinu

Vipengele viwili. Prompt moja. $0.13 kwa uthibitishaji.

Uthibitishaji Imara wa Mteja si ukaguzi mmoja tu, ni mchanganyiko. Washa misamaha kwa kila mtiririko wa kazi. Panda hadi ufunguo wa maunzi kwenye ishara za hatari. Hakuna redeploy.
Soma nyarakaPata API key
01 · Vipengele vya SCA

Vipengele viwili. Kategoria tofauti.

Inherence (Passive Liveness + Face Match 1:1) pamoja na possession (kifaa cha mtumiaji kilichofungamana). Daraja la PSD3 kwa chaguo-msingi. Knowledge factor (PIN, nenosiri) ni ya hiari na inaweza kusanidiwa kwa kila mtiririko wa kazi.
Moduli ya Uthibitishaji wa Biometriska
02 · Dynamic linking

Idhini moja. Imefungamana na kiasi + mpokeaji.

Kwa malipo, changamoto ya uthibitishaji huweka kiasi kamili na mpokeaji. Mtumiaji huona haya kwenye prompt ya biometriska yenyewe. Uharibifu wowote unabatilisha idhini, imejengwa ndani ya PSR.
Marejeleo ya API ya Sessions
03 · Kwa nini SMS OTP inastaafu

Imeundwa kuzuia phishing.

Udanganyifu wa SIM-swap, hadaa ya wakati halisi, kukatiza kwa SS7, yote haya yanashinda nenosiri la mara moja la SMS. Biometriska zinazofungamana na kifaa zenye origin binding huzuia kila shambulio la kawaida ambalo Mamlaka ya Benki ya Ulaya ilitaja katika maoni yake ya SCA ya 2024.
Kuzuia kuchukua akaunti
04 · Injini ya msamaha

Misamaha, iliyorekebishwa kwa kila workflow.

Thamani ya chini ya mbali chini ya EUR 30, point-of-sale isiyo na mawasiliano chini ya EUR 50, inayojirudia sawa, mpokeaji anayeaminika, viwango vya Uchambuzi wa Hatari ya Muamala. Yote yanaweza kuhaririwa katika Workflow Builder isiyo na code.
Workflow Orchestrator
05 · Ishara 200+ kwa kila uthibitishaji

Ishara 200+ kwa kila uthibitisho.

Device fingerprint, IP geolocation, VPN / proxy / datacenter detection, new-device flag, behavioural drift. Panda hadi ufunguo wa maunzi kiotomatiki wakati hatari inapovuka kizingiti chako.
Moduli ya Uchambuzi wa Kifaa & IP
06 · Uchumi

$0.13 per auth, not $0.04 plus SIM-swap loss.

$0.10 Uthibitishaji wa Biometriska + $0.03 Uchambuzi wa Kifaa & IP = $0.13 kwa Uthibitishaji Imara wa Mteja. Nenosiri la mara moja la SMS lina gharama ya $0.04-$0.07 pamoja na kushindwa kwa utoaji, majaribio upya, na hatari ya hasara ya SIM-swap ambayo wadhibiti wanapanga bei katika PSD3.
Bei
Unganisha

Session moja. Gonga mara moja. Webhook moja.

Fungua session na kiasi + mpokeaji. Mtumiaji anaidhinisha kwenye simu yake. Webhook iliyotiwa saini inathibitisha kufungamana.
POST /v3/session/Kuingia
$ curl -X POST https://verification.didit.me/v3/session/ \
  -H "x-api-key: $DIDIT_API_KEY" \
  -d '{
    "workflow_id": "wf_sca_biometric",
    "vendor_data": "user-42",
    "metadata": { "purpose": "login" },
    // base64 KYC enrolment selfie, ≤ 1MB
    "portrait_image": "/9j/4AAQSkZJRgABAQE..."
  }'
201Imeundwahali Imeidhinishwa · Imekataliwa · Inapitiwa
Pitisha selfie ya usajili wa KYC kama portrait_image. Hakuna usajili upya.nyaraka →
POST /v3/session/Malipo
$ curl -X POST https://verification.didit.me/v3/session/ \
  -H "x-api-key: $DIDIT_API_KEY" \
  -d '{
    "workflow_id": "wf_sca_biometric",
    "vendor_data": "user-42",
    "metadata": { "amount": "247.50", "payee_account": "ES91…1332" },
    // base64 KYC enrolment selfie, ≤ 1MB
    "portrait_image": "/9j/4AAQSkZJRgABAQE..."
  }'
201Imeundwawebhook inarudisha kiasi + mpokeaji kwa uthibitisho
Mtumiaji anaona kiasi + mpokeaji kwenye kidokezo cha kibayometriki chenyewe. Dynamic linking.nyaraka →
Ujumuishaji tayari kwa agent

Tuma mtiririko wa PSD3 SCA kwa prompt moja.

Bandika kwenye Claude Code, Cursor, Codex, Devin, Aider, au Replit Agent. Jaza stack yako. Agent inajenga workflow, inaunganisha dynamic linking, inaweka SDK, na inatuma Strong Customer Authentication inayofanya kazi ndani ya dakika tano.
didit-integration-prompt.md
You are integrating Didit's Strong Customer Authentication into a payment service provider, bank, EMI, or wallet to satisfy PSD3 / the Payment Services Regulation (PSR). Two factors in one prompt:

  1. Inherence — Biometric Authentication: Passive Liveness + Face Match 1:1 against the user's previously-enrolled KYC selfie.
  2. Possession — Device & IP Analysis: 200+ real-time fraud signals binding the auth to the user's known device.

Pricing (verified live 2026-05-16):
  - Biometric Authentication: $0.10 per auth
  - Device & IP Analysis: $0.03 per auth
  - Total: $0.13 per Strong Customer Authentication
  - First 500 verifications free every month, forever
  - Re-uses the enrolled selfie from the original KYC — no re-enrolment

PRE-REQUISITES
  - Production API key from https://business.didit.me (sandbox key in 60 seconds, no credit card).
  - Webhook endpoint with HMAC SHA-256 verification of the X-Signature-V2 header.
  - A workflow_id from the no-code Workflow Builder configured as a Biometric Authentication workflow (Passive Liveness + Face Match 1:1 + Device & IP Analysis).
  - The user has previously completed a Didit KYC (the same enrolled selfie backs every subsequent auth).

STEP 1 — Open an authentication session

  POST https://verification.didit.me/v3/session/
  Headers:
    x-api-key: <your api key>
    Content-Type: application/json
  Body (for login auth):
    {
      "workflow_id": "<wf id for SCA biometric auth>",
      "vendor_data": "<your user id>",
      "callback": "https://<your-app>/auth/callback",
      "metadata": {
        "purpose": "login",
        "session_id": "<your front-end session id>"
      },
      "portrait_image": "<base64 JPEG of the user's KYC enrolment selfie, ≤ 1 MB — REQUIRED for SCA's inherence factor; OMIT only if the workflow is liveness-only>"
    }

  Body (for payment with dynamic linking):
    {
      "workflow_id": "<wf id for SCA biometric auth>",
      "vendor_data": "<your user id>",
      "callback": "https://<your-app>/payment/callback",
      "metadata": {
        "purpose": "payment",
        "amount": "247.50",
        "currency": "EUR",
        "payee_account": "ES9121000418450200051332",
        "payee_name": "<merchant or recipient>",
        "transaction_reference": "<your internal transaction id>"
      },
      "portrait_image": "<base64 JPEG of the user's KYC enrolment selfie, ≤ 1 MB — REQUIRED for SCA's inherence factor>"
    }

  Response: 201 Created with the hosted session URL. Push the URL to the user via deep-link / push notification / in-app sheet.

STEP 2 — User completes the biometric auth

  The user sees one prompt on their phone (or via the Didit SDK in your native app). Three things happen on the same screen:

  1. The amount + payee are displayed (dynamic linking — the user explicitly approves THIS amount to THIS payee for payments).
  2. Passive Liveness defeats screen replay, printed photo, mask, deepfake.
  3. Face Match 1:1 matches the new selfie against the enrolled KYC selfie.

  Device & IP Analysis runs server-side on the session. Sub-2-second median verdict.

STEP 3 — Read the signed webhook on the auth verdict

  Didit POSTs to your callback. Session statuses (Title Case With Spaces):

  Body (excerpted):
    {
      "session_id": "<uuid>",
      "vendor_data": "<your user id>",
      "status": "Approved",
      "liveness": { "status": "Approved" },
      "face": { "status": "Approved", "similarity_score": 0.94 },
      "ip_analysis": { "status": "Approved", "vpn_detected": false, "datacenter_ip": false },
      "metadata_echo": {
        "amount": "247.50",
        "payee_account": "ES9121000418450200051332"
      }
    }

  Status enum (exact case): Approved | Declined | In Review | Resubmitted | Expired | Not Finished | Kyc Expired | Abandoned.

  Verify the X-Signature-V2 header BEFORE reading the body — HMAC SHA-256 of the raw bytes with your webhook secret.

  For payments, verify that metadata_echo.amount and metadata_echo.payee_account match the values you passed in. If they do not, REJECT the payment — it's a dynamic-linking violation.

STEP 4 — Branch on verdict

  Approved   → unlock the action (login, payment, account change).
  In Review  → hold the action, route to manual review queue.
  Declined   → block, log the attempt, surface a friendly "try again" to the user.
  Resubmitted → the user re-submitted after a soft fail (poor lighting, occlusion); proceed if the latest status is Approved.

STEP 5 — Retrieve the full decision later

  GET https://verification.didit.me/v3/session/{sessionId}/decision/
  Headers:
    x-api-key: <your api key>

  Returns the full payload: liveness verdict (iBeta Level 1 anti-spoof certified), Face Match similarity score, device fingerprint, IP geolocation, VPN / proxy / datacenter flags, 200+ fraud-signal score, dynamic-linking echo, HMAC signature.

  Use this for the audit-trail surface a regulator examines on Strong Customer Authentication coverage.

STEP 6 — Step up on risk

  When Device & IP Analysis surfaces a high-risk signal (new device + high-value payment, VPN/proxy on a login, geolocation jump), your workflow can step up to:

  - A separate hardware-key challenge (FIDO2 / WebAuthn)
  - A trusted-beneficiary whitelist confirmation
  - A manual-review hold

  Encode the step-up policy in the no-code Workflow Builder — no redeploy required.

WEBHOOK EVENT NAMES
  - Sessions: status changes flow through the standard session webhook.
  Verify X-Signature-V2 on every payload.

CONSTRAINTS
  - Session statuses use Title Case With Spaces. Never UPPER_SNAKE_CASE on a session.
  - Dynamic linking is REQUIRED for payments — pass amount + payee in metadata, verify the echo on the webhook.
  - The enrolled selfie that backs every SCA is the one captured during the user's original KYC — no separate enrolment step.
  - PSD3 / PSR exemptions (low-value remote < EUR 30, contactless point-of-sale < EUR 50, recurring identical, trusted beneficiary, Transaction Risk Analysis tiers) are configured per workflow in the Business Console.
  - Default record retention is 5 years per the EU AML and payments rules.

Read the docs:
  - https://docs.didit.me/sessions-api/create-session
  - https://docs.didit.me/sessions-api/retrieve-session
  - https://docs.didit.me/integration/webhooks

Start free at https://business.didit.me — sandbox key in 60 seconds, 500 verifications free every month, no credit card.
Unahitaji maelezo zaidi? Tazama nyaraka kamili za moduli.docs.didit.me →
Inatii kwa muundo

Fungua nchi mpya kwa kubofya mara moja. Tunafanya kazi ngumu.

Tunafungua kampuni tanzu za ndani, tunapata leseni, tunafanya majaribio ya kupenya, tunapata vyeti, na tunalingana na kila kanuni mpya. Ili kusafirisha uthibitishaji katika nchi mpya, geuza swichi. Nchi 220+ ziko hewani, zinakaguliwa na kupimwa kila robo mwaka, mtoa huduma pekee wa utambulisho ambaye serikali ya nchi mwanachama wa EU imemwita rasmi kuwa salama zaidi kuliko uthibitishaji wa ana kwa ana.
Soma faili ya usalama na utiifu
EU financial sandbox
Tesoro · SEPBLAC · BdE
ISO/IEC 27001
Usalama wa habari · 2026
SOC 2 · Type I
AICPA · 2026
iBeta Level 1 PAD
NIST / NIAP · 2026
GDPR
EU 2016/679
DORA
EU 2022/2554
MiCA
EU 2023/1114
AMLD6 · eIDAS 2.0
EU-aligned kwa muundo

Takwimu za kuthibitisha

Takwimu za kuthibitisha
  • $0.00
    Kwa Uthibitishaji Imara wa Mteja, Uthibitishaji wa Kibayometriki + Uchambuzi wa Kifaa na IP.
  • <0s
    Uthibitishaji kamili kwa kila kipindi, kwenye Android ya kiwango cha chini.
  • 0+
    Ishara za ulaghai za wakati halisi zinazochunguzwa kwa kila uthibitishaji, VPN, kituo cha data, mabadiliko ya eneo, mabadiliko ya kifaa.
  • 0
    Uthibitishaji wa bure kila mwezi, kwa kila akaunti.
Ngazi tatu, orodha moja ya bei

Anza bure. Lipa kulingana na matumizi. Panua hadi Enterprise.

Uthibitishaji 500 bila malipo kila mwezi, milele. Lipa kadri unavyotumia kwa uzalishaji. Mikataba maalum, uhifadhi wa data, na SLA (Service Level Agreements) kwenye Enterprise.
Bure

Bure

$0 / mwezi. Hakuna kadi ya mkopo inayohitajika.

  • Kifurushi cha bure cha KYC (Uthibitishaji wa Kitambulisho + Passive Liveness + Face Match + Uchambuzi wa Kifaa & IP), 500 / mwezi, kila mwezi
  • Watumiaji Waliozuiwa
  • Utambuzi wa Marudio
  • Ishara 200+ za udanganyifu kwenye kila session
  • KYC inayoweza kutumika tena kwenye mtandao wa Didit
  • Jukwaa la Usimamizi wa Kesi
  • Workflow Builder
  • Nyaraka za umma, sandbox, SDKs, server ya MCP (Model Context Protocol)
  • Usaidizi wa jamii
Anza bure
Maarufu zaidi
Lipa kulingana na matumizi

Kulingana na Matumizi

Lipa tu kwa unachotumia. Moduli 25+. Bei za umma kwa kila moduli, hakuna ada ya chini ya kila mwezi.

  • KYC kamili kwa $0.33 (Kitambulisho + Biometric + IP / Kifaa)
  • Data za AML 10,000+, vikwazo, PEPs, habari hasi
  • Vyanzo vya data vya serikali 1,000+ kwa Uthibitishaji wa Database
  • Ufuatiliaji wa Miamala kwa $0.02 kwa kila muamala
  • KYB ya moja kwa moja kwa $2.00 kwa kila biashara
  • Uchunguzi wa Wallet kwa $0.15 kwa kila ukaguzi
  • Mtiririko wa uthibitishaji wa Whitelabel, brand yako, miundombinu yetu
Tazama orodha kamili ya beiAnza bure
Biashara Kubwa

Biashara Kubwa

MSA & SLA maalum. Kwa idadi kubwa na programu zilizodhibitiwa.

  • Mikataba ya kila mwaka
  • MSA, DPA, na SLA maalum
  • Kituo maalum cha Slack na WhatsApp
  • Wakaguzi wa mikono wanapohitajika
  • Masharti ya muuzaji na white-label
  • Vipengele vya kipekee na ushirikiano wa washirika
  • CSM aliyetajwa, ukaguzi wa usalama, usaidizi wa kufuata
Wasiliana nasi

Anza bure → lipa tu wakati ukaguzi unafanyika → fungua Enterprise kwa mkataba maalum, SLA, au uhifadhi wa data.

FAQ

Maswali ya kawaida

What is Didit?

Didit is infrastructure for identity and fraud, the platform we wished existed when we were building products ourselves: open, flexible, and developer-friendly, so it works as a real part of your stack instead of a black box you integrate around.

One API covers verifying people (KYC, know your customer), verifying businesses (KYB, know your business), screening crypto wallets (KYT, know your transaction), and monitoring transactions in real time, on a stack built to be:

  • Fast, sub-2-second p99 on every session
  • Reliable, in production with 1,500+ companies across 220+ countries
  • Secure, SOC 2 Type 1, ISO 27001, GDPR-native, and formally attested by Spain's financial regulator as safer than verifying someone in person

The footprint underneath: 14,000+ document types in 48+ languages, 1,000+ data sources, and 200+ fraud signals on every session. The Didit infrastructure dynamically learns from every session and gets better every day.

What is Strong Customer Authentication, in plain English?

Strong Customer Authentication (SCA) is a rule from the EU's payment-services regulation that says: when a customer logs in to their account or initiates a payment, you must verify them using at least two of three independent factor categories.

The three categories:

  • Knowledge, something only the user knows (password, PIN, secret answer)
  • Possession, something only the user has (phone, hardware key, SIM-bound device)
  • Inherence, something only the user is (fingerprint, face, behavioural pattern)

The two factors must come from different categories, a password plus a security question is not SCA, because both are knowledge. A password plus a fingerprint is, because they cross categories.

A third requirement, dynamic linking, says the second factor for a payment must be tied uniquely to the transaction amount and payee, so a stolen code cannot be replayed against a different transaction.

What is PSD3, and how is it different from PSD2?

PSD3, short for Payment Services Directive 3, is the EU's 2026 rewrite of the rulebook PSD2 introduced in 2018. Alongside it sits the Payment Services Regulation (PSR) which is directly applicable across member states without national transposition.

Key changes over PSD2:

  • Fewer exemptions, the corporate-payments and trusted-beneficiary exemptions are tightened
  • Phishing-resistant SCA mandated, SMS one-time-password is being phased out as the sole second factor; FIDO2, device-bound biometrics, or app-based push become the new default
  • Open-banking access strengthened, banks must offer a clean, unified API; permissioned third-party providers get better technical terms
  • Fraud-liability clarified, payment service providers (PSPs) carry more of the fraud loss when their SCA was weak
  • Wider scope, wallet providers, electronic-money institutions (EMIs), and some crypto providers come into the regime

Transition is rolling, most SCA changes are expected to take effect 18 to 24 months after final adoption.

How fast is the verification for my end user?

The full flow normally takes under 30 seconds end-to-end, pick up the ID, snap the document, snap the selfie, done. That is the fastest in the market. Legacy KYC providers usually take more than 90 seconds for the same flow.

On the back end, Didit returns the result in under two seconds at p99, measured from the moment the user finishes the selfie to the moment your webhook fires. Mobile capture is tuned for slow phones and slow networks: progressive image compression, lazy software development kit load, and a one-tap hand-off from desktop to phone via QR code if the user starts on web.

Which transactions need SCA, and which are exempt?

Need SCA by default:

  • Customer login to a payment account
  • Initiating an electronic payment
  • Any action that could be exploited to commit payment fraud

Exempt (PSD3 keeps most PSD2 exemptions but tightens the thresholds):

  • Low-value remote transactions, under €30 single, with cumulative caps per customer
  • Contactless point-of-sale payments, under €50 single, with cumulative caps
  • Recurring transactions of identical amount and payee, SCA on first, exempt after
  • Trusted beneficiaries, user explicitly whitelists, but PSD3 tightens approval flow
  • Transaction Risk Analysis (TRA), under thresholds linked to your overall fraud rate (1, 5, 10, 25 basis points)
  • Corporate dedicated channels, when both ends are corporate users on a closed system

Getting the exemption math right is the highest-leverage SCA optimisation work most teams do, applied well it drops auth friction without raising fraud.

What happens if a user fails, abandons, or expires?

Every session lands on one of seven clear statuses, so your code always knows what to do:

  • Approved, every check passed. Move the user forward.
  • Declined, one or more checks failed. You can allow the user to resubmit the specific failed step (for example, re-take the selfie) without re-running the whole flow.
  • In Review, flagged for compliance review. Open the case in the console, see every signal, decide approve or decline.
  • In Progress, user is mid-flow.
  • Not Started, link sent, user has not opened it yet. Send a reminder if it sits too long.
  • Abandoned, user opened the link but did not finish in time. Re-engage or expire.
  • Expired, the session link aged out. Create a new session.

A signed webhook fires on every status change, so your database always stays in sync. Abandoned and declined sessions are free.

Where does my customer data live and how is it protected?

Production data is processed and stored in the European Union by default, on Amazon Web Services. Enterprise contracts can request alternative regions for jurisdictions whose regulators require it.

Encryption everywhere. AES-256 at rest across every database, object store, and backup. Transport Layer Security 1.3 in transit on every API call, webhook, and Business Console session. Biometric data is encrypted under a separate Customer Master Key.

Retention is yours to control. Default retention is indefinite (unlimited) unless you configure shorter, between 30 days and 10 years per application, and you can delete any individual session at any time from the dashboard or the API.

Certifications: SOC 2 Type 1 (Type 2 audit in progress), ISO/IEC 27001:2022, iBeta Level 1 PAD, and a public attestation from Spain''s Tesoro / SEPBLAC / CNMV that Didit''s remote identity verification is safer than verifying someone in person. Full report at /security-compliance.

Is Didit compliant for my industry?

Didit ships compliant by default for the regulators that matter to identity infrastructure:

  • GDPR + UK GDPR, controller / processor split, full Data Processing Agreement published, lead supervisory authority named (Spain''s AEPD).
  • AMLD6 + EU AML Single Rulebook, 1,300+ sanctions, politically exposed person, and adverse-media lists screened in real time.
  • eIDAS 2.0, EU Digital Identity Wallet aligned; reusable-identity ready.
  • MiCA (Markets in Crypto-Assets), ready for crypto on-ramps, exchanges, and custodians.
  • DORA, Digital Operational Resilience Act, EU financial-services operational resilience.
  • BIPA, CUBI, Washington HB 1493, CCPA / CPRA, US biometric privacy (Illinois, Texas, Washington) and California consumer privacy.
  • UK Online Safety Act, age-gating and child-safety obligations.
  • FATF Travel Rule, originator and beneficiary data on crypto transfers, IVMS-101 interoperable.

Detailed memo, every certificate, every regulator letter: /security-compliance.

How fast can I integrate and start verifying users?
  • 60 seconds to a sandbox account at business.didit.me, no credit card.
  • 5 minutes to a working verification through Claude Code, Cursor, or any coding agent via our Model Context Protocol (MCP) server.
  • A weekend to a production-ready integration with signed-webhook verification, retries, and a remediation flow when a user is declined.

Three integration paths, pick whichever fits your stack:

  • Embed natively with our Web, iOS, Android, React Native, or Flutter SDK.
  • Redirect the user to the hosted verification page, zero SDK.
  • Send a link by email, SMS, WhatsApp, or any channel, zero front-end work.

Same dashboard, same billing, same pay-per-success price for all three. Step-by-step guide at docs.didit.me/integration/integration-prompt.

How does this work on iOS, Android, and the web?

Same POST /v3/session/ API on every surface, the user-facing capture differs:

  • Web (desktop browser), Didit launches the auth flow in a popup; the user's phone receives a push notification, completes the biometric on the phone, and the popup closes with the approved verdict. Universal-link handoff if the user is on mobile web.
  • Native iOS / Android, drop in the Didit iOS or Android SDK, call the auth method, the OS-native biometric prompt appears (Face ID, Touch ID, fingerprint) backed by the secure enclave
  • React Native / Flutter / Cordova, official SDKs wrap the native modules; identical API surface
  • MCP server, if the auth lives behind an AI agent, the agent calls the auth tool, the user receives a push on their phone, approves, and the verdict returns

The same biometric template the user enrolled at KYC time backs every auth, no re-enrolment, no separate flow.

Does this work outside PSD3 / the EU?

Yes, the same auth bundle satisfies most equivalent global rules:

  • United Kingdom, the FCA's Strong Customer Authentication rules mirror PSD2/PSD3 in substance; Didit's auth bundle qualifies
  • United States, no nationwide SCA mandate, but bank regulators (OCC, Federal Reserve) and the Federal Financial Institutions Examination Council (FFIEC) recommend multi-factor authentication for high-value transactions; Didit drops in
  • Singapore, Monetary Authority of Singapore (MAS) Notice 644 mandates SCA on Internet banking
  • India, Reserve Bank of India two-factor authentication is mandatory on every domestic card transaction
  • Brazil, Banco Central rules align with PSD2-style SCA on instant payments
  • Australia, Japan, South Korea, equivalent multi-factor authentication requirements for banking and high-value e-commerce

One API, one auth bundle, every jurisdiction. The exemption math changes; the technical contract does not.

What does the auth event evidence look like for an examiner?

Every authentication produces a signed evidence record exportable from the Business Console:

  • The auth challenge, timestamp, session ID, requested factors
  • The biometric verdict, Passive Liveness pass/fail, Face Match similarity score (linked to the user's KYC reference selfie), iBeta Level 1 anti-spoof claim
  • The device verdict, device fingerprint, IP geolocation, VPN/proxy/datacenter flags, 200+ fraud-signal score
  • The dynamic-linking payload, amount, payee, timestamp, signed end-to-end
  • The full audit trail, every step state-machined from Pending to Approved or Declined, with reviewer notes if escalated
  • HMAC SHA-256 signature on the payload so chain-of-custody is provable

All records stored in the European Union (EU data centres), retained indefinitely while your subscription is active. Default record retention is 5 years per the EU AML and payments rules, extensible per your supervisor's guidance.

Related

Moduli zinazohusiana + mtiririko wa kazi

Miundombinu ya utambulisho na udanganyifu.

API moja kwa KYC, KYB, Ufuatiliaji wa Miamala, na Uchunguzi wa Wallet. Unganisha ndani ya dakika 5.

Anza bila malipoZungumza nasi
Uliza AI ifupishe ukurasa huu