In brief
Veris never stores biometric data. Not images, not templates, not feature vectors — nothing. Face capture and document extraction run entirely on the user's device; comparison images are processed in memory and deleted the moment a response is returned. This page explains, openly, how our anti-spoofing works, what we test it against, and how we secure the platform.
01Presentation Attack Detection (PAD) transparency
Veris Capture is designed and tested against the presentation attack types defined in ISO/IEC 30107-3, the international standard for biometric presentation attack detection. We publish our attack coverage here so you can evaluate it on the merits.
Transparency note: this reflects our internal testing methodology. It is not an independent laboratory certification — independent certification (iBeta / ISO 30107-3) is on our public roadmap.
| Attack class | Example | Defending layers |
|---|---|---|
| Printed photo | Paper photo held to camera | Texture analysis (LBP), neural anti-spoof, colour-flash reflectance analysis, active challenges |
| Screen replay — static | Photo on a phone/tablet screen | Neural anti-spoof, artifact detection (moiré, flicker), static-frame detection, colour-flash reflectance analysis |
| Screen replay — video | Recorded video on a screen | Temporal analysis, artifact detection, active challenges with randomised order, colour-flash reflectance analysis |
| Live relay | Live video call shown to the camera | Colour-flash reflectance (a relayed screen cannot reflect our randomised light sequence), challenge randomisation |
| Gesture spoofing | Tilting the device to fake a head gesture | Gyroscope-correlated gesture verification — displacement attributable to device motion is rejected |
| Camera injection | Virtual camera / feed injection | On-device injection signal detection, hardware camera attestation, signed results |
02Liveness architecture — defence in depth
No single detector decides. Every capture session runs a layered pipeline, and the final result carries the evidence of every layer:
- Quality gate — 12 image-quality checks before anything else runs.
- Human face validation — geometric and contour analysis confirms a real human face structure.
- Passive liveness — texture analysis plus a neural anti-spoof model, on-device.
- Colour-flash reflectance analysis — the screen emits a randomised colour sequence and the session verifies the scene physically reflects it: screens cannot reflect it at all, and flat media reflect it with a planar signature a real face does not produce.
- Active challenges — randomised blink / nod / head-turn prompts, with device-motion correlation so the gesture must come from the head, not the phone.
- Injection detection — camera hardware attestation and frame-timing analysis against virtual camera attacks.
- Cryptographically signed results — every outcome is signed with a hardware-backed per-device key (ECDSA P-256). Results cannot be forged, replayed, or tampered with in transit.
03Data protection by architecture
- No biometric storage — ever. The face image is delivered to your app and to no one else. Veris servers never receive it during capture.
- On-device processing. Liveness and document extraction run entirely on the user's phone. No round-trips, no image uploads.
- Compare is transient. Images sent to the Compare API are handled in memory for one request, passed over an encrypted connection to a processing partner that does not retain them, and never written to disk or kept by Veris — including when a request fails. No image data is ever logged.
- Telemetry carries no biometrics. Event type, SDK version, success/failure code. No images, no scores that could identify a person, no device fingerprints.
- NDPA-aligned by design. See our NDPA compliance page for the full mapping.
04Platform security
- TLS 1.2+ with HSTS enforced on every Veris domain.
- License keys stored as SHA-256 hashes — never in plaintext, never retrievable.
- Passwords hashed with bcrypt (cost 12+). Webhook and TOTP secrets encrypted at rest.
- Result signing keys live in device secure hardware (StrongBox / TEE) and never leave it.
- Admin operations require two-factor authentication with re-confirmation at execution time; all admin actions are recorded in an append-only audit log.
05Responsible disclosure
Found a vulnerability? We want to hear from you before anyone else does. Email [email protected] with the details. We commit to acknowledging reports within 48 hours, and we will not pursue action against good-faith research.
06Certifications & roadmap
We believe in earning trust with evidence, not badges. Today that evidence is this page, our NDPA alignment, and an architecture where the most sensitive data simply never reaches us. Independent ISO/IEC 30107-3 (iBeta) presentation attack testing is on our roadmap as we grow — and this page will be updated with the results, whatever they are.