Security & governance
Controls your compliance team will recognise.
Identiko is built for institutions that answer to regulators, auditors and the public. Access is scoped to the job, every action is attributed, and every decision leaves evidence.
The controls
Six controls, in plain terms.
Each control is shown working. Pick one, or let the tour run through all six.
01 / 06
Roles & permissions
Built-in roles plus your own custom roles. Developers can integrate without seeing applicant data.
Four built-in roles, plus your own
Illustration: a custom role called Integration developer, with verifications, webhooks and read-only workflows switched on, and applicant data refused.
02 / 06
Two-factor sign-in
2FA for your team, with a second confirmation for sensitive actions.
Asked again for sensitive actions
Illustration: before a workflow is published, the console asks for a two-factor code. Once it is confirmed, Standard KYC v3 is published.
03 / 06
Audit logs
A traceable record of every action in your workspace, including who did it and when.
Who did it, and when
Illustration: audit log entries, each attributed to a person with a time.
04 / 06
Privacy controls
Data export and erasure requests handled from the console.
Files shared through links that expire
Illustration: an erasure request for Omar Nasser is received, the export is ready as a signed link that expires, and the personal data is erased.
05 / 06
Tamper-resistant capture
Camera-only document capture. Liveness that can’t be skipped.
No uploads. No skipping liveness.
Illustration: the applicant scans their ID with the camera. Uploading from the gallery is not offered.
06 / 06
Video evidence
A recording of the session, with the applicant told before the camera opens.
Told before the camera opens
Illustration: the applicant is told the step is recorded before the camera opens.
Built for scrutiny
The AI reads. Your rules decide.
Models read documents and assess risk. They never approve anyone. Every outcome follows rules your team configured, and every step leaves evidence an auditor can follow.
See a case decidedA source for every field
Read from the document, confirmed by a check, or disputed.
Released with a reason
Reviewers release single checks, and the reason is recorded.
Written to the audit log
Every action is attributed and kept with the identity.
Access
Access scoped to the job.
People and integrations get what their work needs, and nothing more.
Four built-in roles, plus your own
A custom role grants only what you tick. Everything else is refused.
Scoped API keys
Each key carries its own scopes and an optional expiry, and can only be given permissions its creator holds.
A second confirmation
Sensitive actions ask for two-factor again, not just at sign-in.
Privacy
Personal data, handled with restraint.
A verification platform holds some of the most sensitive data a person has. These defaults keep it where it belongs.
Export and erasure
Data export and erasure requests are handled from the console.
Expiring file links
Captured images and videos are shared through signed links that expire.
Signal-only webhooks
An endpoint can be set to receive the event without its payload, then fetch the detail itself.
Told before recording
When a flow records video, the applicant is told before the camera opens.
Get started
Run your first verification today.
Start free with credit on us and every check included, or book a demo for your institution.