Trust Center
Enrol once. Be verifiable by anyone you authorise — instantly,
offline, on any phone. This page is the evidence: what we store, what we
can never leak, and the numbers this exact build measured on itself
(last run 07 Jul 2026).
Measured on this build
0.0 TAR delta
Accuracy cost of template protection
Matching in the protected (revocable) domain vs raw —
gate requires < 0.01 absolute at FAR 0.01.
Max per-score difference 9e-08.
1201 chars
Offline QR credential size
Signed face credential — fits a standard QR
(yes at v25/ECC-M).
Verifies in 1.219 ms; a stranger's best
score against one: 0.1328.
1.82 ms
1:N search, 5,000 identities (p50)
Encrypted, protected store; p95 3.18 ms;
top-1 accuracy 100/100; inserts
423/s.
bit-exact
Face pipeline integrity
Live model benchmark over local captures — embeddings and
match decisions reproduce across builds (see face.json for the full
speed/consistency tables).
liveness on by default
Anti-spoofing
A live head-turn challenge ships enabled — a flat photo
or a screen replay can't perform a real 3D turn, so print/replay attacks
are refused. The optional passive anti-spoof score is published
only when measured on a properly licensed, non-training attack dataset
(we don't quote a number we haven't earned).
Every number above is
produced by python -m bench run against this exact codebase —
raw reports in static/trust/. Nothing is quoted from a
datasheet.
What we store — and what we can never leak
- Never images. A face or print becomes a short mathematical template
(an embedding). Photos are discarded after processing.
- Templates are protected (cancelable). Everything used for matching,
sync, or export lives in a scrambled, revocable domain. A copy stolen from
the database, a device, or an export cannot be matched anywhere else — and
can be cancelled like a password (reissue: one click, nobody re-enrols).
- Honest claim: raw templates DO exist — encrypted at rest, on the
server only — solely so a reissue never requires recapture. They never
leave the server; every export and every device carries protected forms only.
- Encryption at rest, per tenant. Each organisation's store has its own
data key (master-wrapped). Offboarding is a crypto-erase: destroy the
keys and every remaining byte — including backups — is permanently unreadable.
- Offline credentials carry their own privacy. A QR card holds a
protected template in its own single-credential domain: unmatchable against
any database, useless without the live person, revocable, expiring.
Revocation, end to end
| If this leaks… | You do… | Result |
|---|
| A database / export copy | Reissue (portal, one click) |
Old copies stop matching instantly; people keep verifying |
| One person's template | Reissue that person |
Their credentials auto-revoke; nobody else affected |
| A printed QR card | Revoke the credential |
Every verifier rejects it at next trust-list refresh |
| An issuer signing key | Rotate the key |
New issues use the new key; old cards stay valid until expiry |
Methodology
Suites run the same code paths production serves — the real store, index,
matcher, credential and liveness modules, not extracts. Protected-domain and
credential suites use synthetic unit embeddings (the transform's accuracy
properties are independent of the data); face/print suites run the live models
over local captures; PAD requires a physical attack set and is only published
once measured. Cross-platform behaviour (Android) is pinned by golden-vector
tests generated from the server code.
Compliance
The compliance dossier (docs/trust/compliance.md in the
distribution) maps Ghana's Data Protection Act (Act 843) and the GDPR to the
concrete product mechanisms above — lawful basis, subject rights, retention,
erasure — each tied to the code path that enforces it.