Trust center
No badge wall. Here’s what’s actually true.
This page separates three things vendors like to blur: what is cryptographically verifiable today, what is our process, and what has been certified by a third party. The third list is currently empty — and we’d rather tell you that than imply otherwise.
Shipped and verifiable
What's real today.
Eight specific guarantees. Each one is shipped behaviour you can exercise against the API — not a roadmap item wearing a shield icon.
Ed25519-signed results
Every verification response is signed. Fetch the public key at GET /v1/verification-key and verify any result offline — prove to an auditor it wasn't tampered with, without trusting us.
HMAC-signed webhooks
Webhook deliveries are HMAC-signed so your receiver can authenticate them, retried with backoff, and constrained by an SSRF egress allowlist on our side.
Revocable biometric templates
An ISO/IEC 24745-style template scheme: a non-invertible, per-tenant-keyed transform of the face embedding. A leaked template can be revoked and re-issued — the raw biometric never has to be the stored asset.
Self-hosting, for real
One pure-Rust binary with embedded migrations on your infrastructure — images never reach Neetix at all. Since v0.3.0 the face models are MIT/Apache-2.0 licensed, so the deployment carries no third-party model agreement.
Images processed in memory
Selfies and documents are decoded, scored and discarded within the request by default — not written to disk, not used for training, never pooled across customers. Retention windows for review images are tenant-configured.
Per-request audit log
Every API call writes an audit row — timestamp, endpoint, key identifier, scores, decision, credits. Any verification decision can be reconstructed later, which is what a dispute actually requires.
Encrypted transport
All managed-API traffic is TLS-encrypted in transit. Keys, images and results are never sent in plaintext.
API keys stored as hashes
Your key is shown once at signup and stored only as a salted hash. We can verify a key; we cannot read it back. Test-mode keys keep integration traffic away from live credits.
Certification status
Nothing on this page is certified. Yet.
External testing is on our roadmap and we will publish results when they exist. Until then, here is the status of every scheme a face-KYC buyer usually asks about — in plain words.
| Scheme | What it covers | Our status |
|---|---|---|
| ISO/IEC 30107-3 PAD testing (iBeta) | Presentation attack detection, tested by an accredited lab | Not yet tested — planned |
| CEN/TS 18099 (injection attack detection) | IAD testing, a lab program live since 2026 | Not yet tested — on the roadmap |
| FIDO Face Verification | Accuracy + demographic-bias certification | Not certified |
| SOC 2 | Organisational security controls audit | Not audited — planned |
| ISO/IEC 27001 | Information security management certification | Not certified |
Internally, anti-spoof models are exercised against iBeta-style PAD protocols — that is engineering discipline, not a certification claim, and we label it accordingly.
How to read certification claims — anyone’s
There is no such thing as “ISO certified” liveness. ISO publishes the testing standard; accredited labs such as iBeta test products against it and report conformance at a stated level. The only correct claim form is “tested by iBeta, found conformant to ISO/IEC 30107-3 at Level N” — named lab, named level, and only after the test actually happened. When ours happens, that is exactly the sentence you will read here. A vendor using looser language on this point is telling you something useful about the rest of their claims.
Data handling
DPDP-aligned by design.
Under India's DPDP Act, your organisation is the data fiduciary and Neetix processes on your instruction — a role we keep deliberately narrow.
- Verification images are processed in memory and not retained by default; audit logs keep metadata and scores, never image content.
- No cross-customer face galleries, no training on submitted images, no sale or sharing of biometric data.
- Account data is deletable on request; DSAR export is built into the console.
- For deployments where images must never leave your infrastructure, the self-hosted binary removes Neetix from the data path entirely.
The binding version of all of this is the privacy policy — written to be read, not skimmed past.
Security review
Put our posture through your process.
Security documentation is available on request, and every cryptographic claim above can be verified against the live API before you talk to anyone.
GET /v1/verification-key · verify any signed result offline