# Hanzo IDV — Hanzo AI

> Identity verification for regulated workflows. KYC, KYB, and AML in a single API.

# Hanzo IDV

Hanzo IDV is one interface in front of the identity-verification vendors, so which vendor you use is a line of configuration rather than a rewrite of your onboarding. It does not verify anybody itself. It starts a check with the provider you chose, reads the verdict back, and proves that a callback came from them and not from someone who guessed the URL. Jumio and Onfido work end to end today; Plaid works by polling; the rest refuse until their response parsing is written, which is stated here because a verification service that guesses is worse than one that says it cannot tell.

[Get started](https://docs.hanzo.ai/docs/services/iam/provider/idv/overview)[View on GitHub](https://github.com/hanzoai)

### Four calls, whichever vendor

Start a verification, check its status, parse a webhook, name yourself. Every provider implements the same four, so swapping one for another is configuration and not a rewrite of your onboarding.

### A verdict, or nothing

A provider whose response we do not parse refuses rather than answering. Two of them used to return approved without reading the reply — one for any response that was not an error, the other including a rejected document. Anything gating on that would have admitted an unverified person, so both now refuse until the parsing is written.

### A webhook has to prove it is one

Signatures are HMAC-SHA256 over the raw body, compared in constant time, with the header matched case-insensitively because the wire spelling and the canonical spelling differ. An empty signing secret is a refusal, never a skip — an HMAC under a key everybody knows is one anybody can compute.

### Polling where a callback cannot be trusted

Every result is verified before it counts. A webhook whose signature we can check is accepted; anything else is polled from the provider directly, so the verdict always comes from the source.

### Credentials come from KMS

The API token bills per check and the webhook token is what separates a provider's verdict from a forgery, so neither is a literal in the code and neither falls back to an environment variable. A missing secret fails at construction rather than producing a provider that quietly runs without one.

### Verification is not screening

Proving somebody is who they say is a different job from watching what they do afterwards. Sanctions lists, transaction monitoring, cases and the five-year record clock live in Hanzo Risk, and this does not duplicate them.

## Get started with IDV

[Read the docs](https://docs.hanzo.ai/docs/services/iam/provider/idv/overview)[View on GitHub](https://github.com/hanzoai)

## Open source

License: Apache-2.0[hanzoai](https://github.com/hanzoai)

## Get IDV

Identity verification

[Deploy to Cloud](https://console.hanzo.ai/deploy)[Self-host](https://docs.hanzo.ai/docs/services/iam/provider/idv/overview)