First release
The whole platform, end to end: a Rust engine with its own MRZ, India, vision and AML crates, the public and console APIs, the hosted verification flow and the console.
21 changes shown
- Fix
Security · Keyed document fingerprints
Duplicate-detection fingerprints are HMAC-SHA256 under a key derived from
KYC_MASTER_KEY, salted per organisation, and no longer appear in identities, Decisions or webhooks. Migration 0002 drops the old unkeyed fingerprints.ed0a488 - Fix
Security · Purge that ends sessions
A purge takes the session lock, refuses a
processingsession with 409, ends an open one asexpired, and scrubs warnings, review notes and the Decision in stored webhook deliveries.ed0a488 - Fix
Security · Bounded image decoding and abuse limits
Images over 8,192 px a side or 24 MP are refused before decoding; failed sign-ins per account, sign-ups per instance and email codes per address and organisation are limited; console writes require a same-origin request.
ed0a488 - Fix
Documents · Specimen documents never auto-approve on live apps
An ICAO specimen (issuing state Utopia) is held for review with
document_specimenon live apps and accepted with an info warning in sandbox. Documents from Kosovo, the EU, UN bodies and the Order of Malta can now be declared.802acb7 - Fix
Console · Webhook test shows the real outcome
Send test now returns after the first attempt and the page reports what happened; redeliveries keep polling until their outcome lands. Signed-out console visits redirect to sign-in.
802acb7 - New
Testing · Runnable end-to-end suite
One script drives a running stack: sign-up, keys, signed webhooks, list refresh, every /v1 check, the hosted flow to a decision, duplicates, review, tenancy and purge.
225edff - Fix
Documents · Reliable MRZ reading from photos
The MRZ is read at several scales and merged; check-digit fields come only from a reading that verifies, so the specimen reads correctly in OCR-B and common monospace fonts.
225edff - Faster
AML · Faster sanctions index in development builds
kyc-aml is optimised even in dev builds so list indexing and screening stay quick locally.
c67f0a0 - Fix
API · Thresholds serialise as typed
Workflow thresholds round-trip as the decimal the operator typed (0.9, not 0.8999999761).
e3f4497 - New
Console · Operations pages
Dashboard, sessions list and detail, the review queue and verification links.
d32c2e7 - New
Console · Configuration pages
Workflows and the workflow builder, webhooks and deliveries, API keys, API docs, AML lists, settings, team and the audit log.
53acac3 - New
Hosted flow · Verification flow at /verify/[token]
Consent, email OTP, document capture, Aadhaar QR and Offline XML, PAN, guided liveness and submit, on any phone or laptop browser.
4f45b42 - New
India · PAN, Verhoeff and Aadhaar offline verification
PAN validation, Verhoeff checksums, Aadhaar Secure QR and Offline e-KYC XML with UIDAI signature verification, and extractors for Indian cards.
d92d9c0 - New
API · Verification engine
Sessions, decisions, the hosted-flow API, the checks engine and submit pipeline, AML list management, and public and console session routes.
8578f77 - New
Console · Design system, shell and auth
The console design system, application shell, sign-in and sign-up pages, and the first landing page.
ad81774 - New
Vision · kyc-vision on a pure-Rust runtime
YuNet face detection, SFace embeddings, head pose, active liveness analysis, image quality and OCR with an MRZ band reader.
b139327 - New
Documents · ICAO 9303 MRZ parser
TD1, TD2, TD3, MRV-A, MRV-B and the French ID; 7-3-1 check digits including long TD1/TD2 numbers; field-aware OCR correction; MRZ location in noisy OCR.
8c52468 - New
AML · OFAC SDN and UN parsers with fuzzy screening
Parsers for both lists with aliases and dates of birth, name normalisation, and an order-insensitive fuzzy index.
6191e09 - New
API · Console platform
Authentication, stats, apps, API keys, workflows, team, audit and webhook deliveries, with the delivery and retention workers.
b7b5f78 - New
API · Shared foundations
Auth extractors, encrypted storage, the rate limiter, the audit log and webhook signing with a persisted queue.
77f1fda - Chore
Repository · Skeleton and contract
ARCHITECTURE.md, the database schema, the crate interfaces and the Next.js scaffold.
395788d