Trusty reads the identity document, confirms a live person with a guided video selfie, matches the face, and returns a signed decision — inside one iframe on your page.
Runs on the Cloudflare edge — decisions close to your users
The whole check runs inside one iframe. Your backend receives exactly one signed webhook per verification.
The user photographs their passport, national ID or driver’s license in a guided capture — on the same device, or handed off from desktop to their phone via QR.
Vision models extract the holder’s data into structured JSON and check expiry dates and field consistency.
A short guided video selfie confirms a live person is present: challenge de giro de cabeza, screen-recapture and printed-photo signals.
The live face is compared with the document photo. You receive a signed decision — approved or rejected — with evidence retained.
Each capability feeds the next. The output is always the same: a decision you can defend.
AI vision models extract structured JSON — names, numbers, dates — with expiry and consistency checks on every field.
A guided video selfie with head-turn challenge captures the signals that flag screen recaptures and printed photos.
The face captured during liveness is scored against the document portrait. The similarity score travels in every decision payload.
Approved or rejected — each outcome is signed, searchable in the per-tenant backoffice, and backed by retained evidence.
{ "event": "kyc.verification.completed", "status": "approved", "verification_id": "ver_9f2c41", "checks": { "document": "valid", "liveness": "pass", "face_match": 0.98 }, "metadata": { "userId": "123" } }
Embed one iframe. Verify one signature. Your users never leave your page.
Paste a single iframe tag with your public token and optional passthrough metadata.
Every decision arrives with an HMAC-SHA256 signature. Compare in constant time, then read the payload.
<iframe
src="https://trusty.sh/verify?public_token=TR_PUB_XXX&lang=es&metadata=%7B%22userId%22%3A%22123%22%7D"
style="width:100%;max-width:420px;height:640px;border:0"
allow="camera">
</iframe>import { createHmac, timingSafeEqual } from 'node:crypto'
const expected = createHmac('sha256', process.env.TRUSTY_WEBHOOK_SECRET)
.update(rawBody)
.digest('hex')
const valid = timingSafeEqual(
Buffer.from(signatureHeader), // X-Trusty-Signature
Buffer.from(`sha256=${expected}`)
)
if (valid) {
// event: kyc.verification.completed
// status: "approved" | "rejected"
// metadata: your passthrough JSON, intact
}Public documentation and sandbox are in progress. Request access with your sales contact.
Request developer accessContexts where a structured KYC check changes the risk profile of onboarding. Presented as use cases, not client claims.
Verify customers before granting access to regulated financial products such as accounts, cards and credit.
Support age and identity checks during player onboarding and account review.
Verify sellers, professionals or high-risk users before enabling sensitive actions such as payouts.
Anchor wallet opening and fiat on-off ramps to a real, verified identity.
Gate regulated or high-trust actions behind an identity check without breaking the user flow.
Identity evidence demands the highest care. Every layer of the platform is designed around that fact.
TLS 1.3 in transit and server-side encryption at rest for every biometric artifact we store.
Images live in non-public buckets, reachable only through authenticated, audited proxy endpoints.
Public tokens only work from domains you explicitly whitelist — spoofed embeds are rejected at the edge.
Each client gets an independent webhook signing secret. Rotate it anytime from the dashboard.
Short-lived JWT sessions with SUPER_USER, CLIENT_ADMIN and MANAGER roles, strictly scoped per tenant.
Your metadata passes through untouched. PII is isolated per tenant and deleted on cascade.
Designed for GDPR-aligned data handling.
One metric, no hidden costs, no egress surprises.
100 verifications included / month
then $0.90 per additional verification
For evaluation and small pilots.
Unlimited volume, custom pricing
For regulated and high-volume teams.
Trusty reads identity documents, confirms liveness with a guided video selfie, and matches the captured face with the document photo. The result is delivered as a signed decision — approved or rejected — with retained evidence.
A user opens the embedded iframe, presents an identity document, completes a short video selfie, and Trusty returns a structured decision through a signed webhook. Cross-device handoff lets desktop sessions continue on the user’s phone camera.
The guided video selfie uses a head-turn challenge and captures liveness signals that flag screen recaptures and printed photos. Those signals, plus the face-match score, feed every decision.
Vision models read passports, national IDs and driver’s licenses into structured JSON. For document coverage specific to your markets, ask your sales contact.
The verification flow runs in any modern browser through a single iframe. Desktop sessions can hand off to the user’s phone camera via a secure QR code — no app install required.
Each decision is delivered to your endpoint as an HTTP request with an HMAC-SHA256 signature in the X-Trusty-Signature header, plus your original passthrough metadata. The event type is kyc.verification.completed.
TLS 1.3 in transit, server-side encryption at rest, non-public buckets behind authenticated and audited proxy endpoints, per-tenant data isolation with cascade deletion, and configurable evidence retention. Designed for GDPR-aligned handling.
Book a demo through the contact form or email sales@trusty.sh. Average first response is under 4 business hours.
Tell us about your product and what you need to verify. We will get back to you within one business day.
Submitting opens your email client with the message pre-filled, addressed to sales@trusty.sh.
Book a walkthrough with the Trusty team. We will map the flow to your onboarding step and your compliance process.