Standards & Certifications
The IDV Platform is built on Innovatrics biometric algorithms, which have been independently benchmarked by NIST and ranked among top performers since 2004. This page lists the standards and evaluations the platform's capabilities align with, and the platform's privacy and security posture.
Biometric benchmarks
| Capability | Benchmark |
|---|
| Face recognition 1:N | NIST FRTE 1:N — one-to-many identification accuracy and speed. |
| Face recognition 1:1 | NIST FRTE 1:1 — one-to-one verification accuracy and speed. |
| Age estimation | NIST FATE AEV — automated age estimation from facial images (ranked #1, lowest mean absolute error). |
Presentation Attack Detection (liveness)
Passive and active liveness both defend against presentation attacks (printed photos, screens, masks); deepfake and injection-attack detection extend this to digital attacks.
Document & image quality
Privacy
| Area | Posture |
|---|
| GDPR | On the session-based tier, no personal data is retained after the session. On the stored tier, data is retained for the Customer relationship and erased on anonymization. |
| Erasure and backups | Backups are used only for disaster recovery and are not edited; erased data ages out of them with the backup retention period. Every anonymization is recorded in a separate erasure log and re-applied after a restore, so erased data does not return to the live system. See Data retention and GDPR. |
| Data minimisation | Without the 1:N add-on, the face template kept for 1:1 face comparison is not added to any searchable face index. |
| Data in transit / at rest | Encrypted in transit everywhere; at rest on the stored tier. |
| Area | Posture |
|---|
| Tenant isolation | Every tenant has its own database for Customer and Digital Identity records. The tenant of an API or dashboard request is taken from the authenticated credential or session, never from a tenant identifier the caller supplies, and every read of stored images and exports is checked against the caller's tenant. |
| Independent review | The multi-tenant architecture has been reviewed by an external security firm; tenant isolation, role management and the identity-provider configuration were hardened across services as a result. |
| Access control | Dashboard roles can be changed only by an organization administrator, never on their own account, and every role change is audit-logged. Configuration changes are attributed to the authenticated user who made them. |
| Abuse protection | API calls are rate-limited per tenant, dashboard sign-ins are rate-limited, and repeated rejected verifications from one client address are refused for a period of time. |
| Self-hosted isolation | A self-hosted installation serves one Company; inside the cluster, the internal biometric and search components accept connections only from the platform services that call them. See Self-hosted installation. |
See also