The identity layer
We prove live people, not a photo.
Every face already sits at a coordinate in one continuous space. oneface reads three seconds of living tissue, lights up that point, and from then on the same person is recognised anywhere on the network — with no password, no token, no device and nothing stored.Claim once, authenticate forever · free to recognise, at any volume · non-custodial by architecture
Legacy model · every identity system until now
An empty drawer you fill inYou declare who you are, upload a document, wait for approval, and the provider writes a file. Your identity becomes a record in someone’s database — so it can leak, be sold, be duplicated in eleven places, and be checked again at a cost, forever.Onboarding measured in minutes, sometimes daysA stored biometric that exists whether you are there or notA per-check fee that scales with your success
oneface · advanced biometrics
A coordinate you light upFacial geometry and the pulse under your skin resolve to one point in a continuous vector space. Nothing is created in that moment and nothing is filed — the reading computes where you already fall, proves you are alive there, and emits a proof that expires.Three seconds, once — then nothing, for lifeNothing at rest to steal, because nothing is at restOne anchoring fee, then re-authentication is free
Edge processing technologyAll biometrics and liveness are processed on your own device. Nothing is stored in a database — your information stays with you.
Integrate now →The technology
Four pieces, and none of them is a database
Written for engineers. If you are evaluating this against a vendor that stores templates, these are the four places the architectures diverge.FACE SCANA live humanOne capture, three seconds
01 · rPPGLive pulseBlood flow read from light
Speech–pulse correlationAnti-coercionSpeech correlated with the pulse the camera reads in the same instant proves a living person is present, and cloned audio cannot produce that coincidence.
03 · Three shardsCryptographyAny two rebuild it, one is noise
04 · ProofBiometric proofAnchored, and the answer only
01 · rPPGRemote photoplethysmography — reading the pulse from lightEach heartbeat changes the volume of blood in the capillaries just under the skin, and that changes how much light the skin absorbs. The shift is far too small for a human eye and entirely legible to a sensor. Over three seconds we extract the waveform, check it for a plausible cardiac rhythm, and confirm it is consistent across facial regions that share a blood supply.
A printed photograph, a replayed video and a silicone mask return no waveform at all. That is a categorical absence, not a low score — which is why it cannot be tuned around.
02 · The vector spaceA face becomes a point in more than a thousand dimensionsGeometry and the vascular signature are encoded into a high-dimensional embedding. The number of distinguishable positions in that space is astronomically larger than the human population, so two living people producing the same coordinate is outside what the space permits rather than merely improbable.
Identical twins share genes, not vasculature. The pattern of blood under the skin separates them — the part conventional face recognition cannot do.
03 · Three shardsThe coordinate is split so no single holder has itThe vector is divided using a threshold scheme into three shards: one on the user’s device, one with the relying party, one in the recovery set. Any two reconstruct the coordinate; any one alone is mathematically meaningless — not encrypted, but genuinely without information.
It means a breach of us yields a shard, and a shard is noise. It also means losing a phone does not lose the identity: the remaining two rebuild it.
04 · Zero-knowledge proofAnswer the question, and disclose nothing elseThe device produces a proof that a statement is true — this tissue is alive, it sits at the coordinate this party knows, and it authorised this request now — without transmitting the coordinate, the reading or the image. The verifier gets a cryptographic guarantee and no data.
It is also how a predicate works. Over eighteen: true. Licensed: true. The asking party gets an answer instead of a document, so there is nothing for them to store, leak or be subpoenaed for.
Where each shard lives, and what it is worth aloneTwo of three reconstruct. One of three is noise. There is no configuration in which Sidaxis holds two.
1On the deviceHeld in the secure element, released only to a live reading from the person it belongs to. Wiped with the phone.
2With the relying partyBlinded to their own identifier, so it is useless at any other company — and useless to an attacker who takes it.
3In recoverySealed for the case of a lost device. Reconstructs only alongside a fresh live reading, never on request.
Non-custodial is a capability we lackA promise not to look is worth what the company making it is worth on the day it is acquired. A split that leaves us holding one shard survives the acquisition, the subpoena and the change of management.We hold no image, no template, no full coordinate and no master key. Not as policy — as architecture.
FaceToken — what the relying party actually receives
A FaceToken is the durable handle you store in your own database in place of a person. It is derived from the coordinate and your public identifier together, so it is stable for you forever and meaningless everywhere else.It carries no biometric and cannot be reversed into one. If your database is breached, what leaks is a string that unlocks nothing, identifies no one outside your walls, and cannot be replayed against another company.
What you storefacetoken: "0xA1f3…7c04"
stable: forever, for you
portable: no
reversible: no
biometric: none
One person, one identity, no tracking
A universal identity that cannot be used to follow you
This is the objection every universal identity system fails. If one key opens everything, whoever collects the keys watches everything. oneface answers it in the derivation: each party receives a different value for the same person.Your bank sees
0xA1f3…7c04Stable forever, so it recognises you on every visit — and useless anywhere else.A shop sees
0xB9e2…31daA different value for the same face. The two cannot be matched, even if both companies try.Sidaxis sees
—Nothing. The derivation happens on your device and we are not a party to it. We cannot correlate what we never receive.Need customer data? Ask for it.
Tick what your business actually requires and the request appears in the person’s wallet. They approve in one tap, you receive an answer rather than a document, and both sides get a receipt showing exactly what was shared and when.Access is revocable at any time, by them, without asking you.Why this had to be architectural
A promise not to correlate is worth what the company promising it is worth on the day it is acquired. A derivation that makes correlation impossible survives the acquisition, the subpoena and the change of management.It is built so that trusting us is not required.The first time in your life
The coordinate proves you are a unique living human. Attaching a legal identity to it needs a source a stranger cannot forge — and the right source depends on where you are.Nobody types their identity into a text box
First choiceOpen financeA consented account link returns the verified account holder. The bank already did the checking, under regulation.Brazil · UK · EU · Australia · LatAm
Strongest proofe-ID over NFCHold the passport or national ID against the phone. The chip is signed by the issuing government.Almost every country · ICAO 9303
No forms, no codeSilent network authThe mobile network confirms the line from the SIM itself, and reports whether it was swapped recently.GSMA Open Gateway · global
FallbackBureau attestationWhere none of the above reaches, an established bureau confirms the record — returned as a proof, not a file of your data.United States · Canada · elsewhere
Login with oneface
Social login tells you an email address exists. This tells you a real, verified human is on the other side — with their document already checked.One button. Signed in, verified and known at once.
Create your account
Continue with oneface
OR
Continue with Google
Sign up with email
KYC comes in the button
Identity, liveness, document and screening are already done when the person lands in your product. No second step, no drop-off, no vendor.One human, one account
The same person cannot open eleven accounts with eleven emails. Promo abuse, ban evasion and fake reviews stop being a cat-and-mouse game.Nothing passes through us
Non-custodial by design. We do not hold the data, so we cannot lose it, sell it or hand it over — and neither can whoever buys us one day.Free to recognise, forever
You pay the first time you meet someone. Every recognition after that costs nothing, at any volume.FaceWallet™
Everything you carry, held to your face instead of a device
Cards, credentials, licences, tickets and keys are tokenised and bound to your coordinate. You associate them once, use them with a face scan, and revoke any of them in one tap. Nothing sits on a phone, so nothing is lost with the phone.Associate, use and revoke — all with a face scan
Deviceless transactions: no phone, no card, no code
Stolen or lost means nothing — there is nothing to take
Payment accounttokenised · open finance
ACTIVEDriving licenceissuer-signed · verified
ACTIVEEvent ticket · row Fbound to your face
ACTIVEOld gym membershipaccess stopped instantly
REVOKEDSign in · sign · pay · share · check in · authorise
Three seconds, and the rest of the flow disappears
Open protocol
Integrate in one click, and store nothing
The spec is published, the SDK is one dependency, and the MCP server lets an AI drive verification without anyone writing an integration. You ask a question and get an answer — is this a live human, is this the same person, are they over eighteen.REST, SDK and an MCP server any agent runtime can call
Web, native, kiosk, terminal or gate — the same coordinate
Sandbox keys instantly, production the same afternoon
The whole integration
const { proof } = await oneface.verify({
ask: 'is_live_human'
})
// nothing uploaded, nothing stored
// the proof is yours, and it expiresmcp.sidaxis.comverify_human · request_claim · share_attribute · revoke
The industry todayA fee on every check
Ten million logins is ten million chargesEach vendor holds its own copy of your customers’ facesEvery company re-verifies the same person, separatelyYour cost grows in lockstep with your growth
oneface · advanced biometrics
A fee on the first claim, onceRe-authentication is free, at any volume, for lifeLiveness runs on the customer’s own deviceYou hold a FaceToken, not a face — nothing to breachNo recurring fee for liveness, KYC or re-authentication
See the rates ↗Proprietary technology
Filed as a provisional application, covering the coordinate resolution, the liveness reading and the per-party derivation.Fourteen patent claims, and none of them describe a database
Nothing to store. Nothing to attack. Nothing to steal.
The image of your face — discarded in the same second it is readA reversible template that could be turned back into a faceA master key, here or anywhere, that could unlock the networkA credential at rest, waiting to be copied or transferred
A breach of our infrastructure yields proofs of past events and one shard. It does not yield a single person’s biometric, because we do not have one.Honest about the hard partThe threat that matters is not someone guessing your coordinate — it is software convincing the camera that a recording is a person. That is why liveness is bound to the device’s secure hardware and every request carries a challenge that expires in seconds.A proof issued for a login cannot be replayed to approve a payment.Read the security model ↗
neface