Question 1

What is Didit?

Accepted Answer

Didit is **infrastructure for identity and fraud** — the platform we wished existed when we were building products ourselves: **open, flexible, and developer-friendly**, so it works as a real part of your stack instead of a black box you integrate around.

One API covers verifying people (**KYC**, *know your customer*), verifying businesses (**KYB**, *know your business*), screening crypto wallets (**KYT**, *know your transaction*), and monitoring transactions in real time — on a stack built to be:

- **Fast** — sub-2-second p99 on every session.
- **Reliable** — in production with **1,500+ companies** across **220+ countries**.
- **Secure** — SOC 2 Type 1, ISO 27001, GDPR-native, and formally attested by Spain's financial regulator as safer than verifying someone in person.

The footprint underneath: **14,000+ document types** in **48+ languages**, **1,000+ data sources**, and **200+ fraud signals** on every session. The Didit infrastructure learns from every session and gets better every day.

Question 2

How do I migrate from Ondato to Didit?

Accepted Answer

Two paths — pick the one that suits your team.

- **Self-serve in a weekend.** Open the sandbox at [business.didit.me](https://business.didit.me), get an API key in under a minute, swap your `POST /v3/session/` endpoint, repoint your webhook, ship. Same-shape request, same-shape response.
- **White-glove with our team.** Email `hello@didit.me` and our migrations team takes it end to end — we have done dozens of these for every major Know Your Customer (KYC), Know Your Business (KYB), Transaction Monitoring, and Wallet Screening provider.

Either path: same `/v3/` API covers KYC, KYB, Transaction Monitoring, and Wallet Screening. **500 verifications free every month, forever**, no contract to break.

Question 3

Will Didit support the same documents and countries Ondato does?

Accepted Answer

**Yes — almost certainly more.**

- **14,000+ document types** across **220+ countries and territories**.
- **48+ languages** on the hosted user-facing flow.
- Every module Ondato ships — Identity Document Verification, NFC chip reading, Proof of Address, Passive + Active Liveness, Face Match 1:1, Face Search 1:N, Age Estimation, Biometric Auth, AML, Device & IP analysis — runs on one API.

If a document or country you need isn't already covered, **tell us — we add roughly one new document family per month** and the data-science team prioritises requests from active customers.

Question 4

How similar is Didit's API to Ondato's?

Accepted Answer

Same shape, simpler contract. If you've integrated Ondato, Sumsub, Persona, Veriff, Jumio, Onfido, or any other modern identity platform, you already know the model:

- Call **`POST /v3/session/`** with a `workflow_id` and a `vendor_data` identifier.
- **Redirect or embed** the verification URL returned in the response.
- **Receive a signed webhook** (HMAC-SHA-256) with the verdict.

One `/v3/` namespace covers KYC, KYB, Transaction Monitoring, and Wallet Screening. One authentication header, one webhook receiver. SDKs for **Web, iOS, Android, React Native, and Flutter** — same packaging your engineers already use.

Question 5

Can I run Didit side-by-side with Ondato before cutting over?

Accepted Answer

Yes — most teams do, and we recommend it.

- **Mirror 10 % of your traffic** to Didit while Ondato keeps handling the rest.
- **Compare verdicts** — same user, both vendors, side by side in the console.
- **Flip the rest** when you're satisfied with pass rates, latency, and fraud catch.

A re-keying script ships with every migration so your internal user IDs map cleanly to Didit session IDs. **No double-billing** — your Didit clock starts only when you flip.

Question 6

Am I locked into a Didit contract? Can I keep my current Wallet Screening or AML vendor?

Accepted Answer

**No lock-in. Bring whatever you already have.**

- **No annual contract, no minimum spend, no per-seat licence on Didit.** Pay-per-success, that's it. If we ever stop earning the work, you leave on the same terms.
- **Wallet Screening (Know Your Transaction)** — use Didit's built-in screening at `$0.15` per check, or **bring your own provider** (Crystal, Merkle Science) and run it inside Didit on the same `/v3/` contract for `$0.02` per check.
- **AML Screening** — Didit's `$0.20` AML check is one option; partner integrations or your existing screening tool are first-class alternatives.
- **Transaction Monitoring** — use Didit's 11 seeded rule bundles, or bring your own rule engine via webhook subscriptions.

The open-marketplace pattern is on by design — a new partner module ships roughly every quarter.

Question 7

What does Didit cost — and what happens at scale?

Accepted Answer

Everything is publicly priced. No quote form, no minimum. The headline numbers:

- **Full KYC bundle: $0.33** (ID + Liveness + Face Match + IP).
- **Wallet Screening: $0.15 per check** — or bring your own provider for $0.02.
- **Live KYB: $2.00 per business** (with a linked KYC for every Ultimate Beneficial Owner).
- **Ongoing AML monitoring: $0.07 per user, per year.**
- **500 verifications free every month, forever** — no credit card.

Past the free tier, volume discounts kick in automatically. Enterprise adds a custom contract, SLA, data-residency choice, and a dedicated Slack + WhatsApp channel.

Question 8

Is Didit compliant for regulated industries?

Accepted Answer

Yes — and we can prove it on paper.

We're the only identity-verification platform an EU national government has formally said is **safer than meeting someone in person**. Spain's **Tesoro**, the **Banco de España**, and **SEPBLAC** reviewed our architecture and the maths. The full report is public.

Certifications:

- **SOC 2 Type 1** (Type 2 audit in progress).
- **ISO/IEC 27001:2022.**
- **iBeta Level 1** anti-spoofing.
- **GDPR-native**, with **EU data residency** by default.

Aligned with AMLD6, MiCA, eIDAS 2.0, and DORA. Every certificate and audit report lives on [/security-compliance](/security-compliance) — request the Trust Pack and we send it back in one PDF.

Question 9

How does Didit catch deepfakes, face swaps, and AI-generated documents?

Accepted Answer

Every session runs **200+ fraud signals** in real time. The ones people ask about most:

- **Liveness** — proves the person is real and present (not a photo, video replay, or AI-generated face). iBeta Level 1 certified.
- **Face matching** — checks the selfie matches the document, and catches face-morph attacks.
- **Document tampering** — flags edits, splices, and AI-generated documents.
- **AML + sanctions + PEP screening** — checked against **1,300+ lists** in the same call.
- **IP + device intelligence** — network, fingerprint, and behavioural heuristics.

We run automated monitoring and retraining loops on autopilot. Every new attack pattern we see gets folded back into the models continuously — your defences improve without you migrating or upgrading anything.

Question 10

Can my AI coding agent integrate Didit without me in the loop?

Accepted Answer

Yes — we built Didit for humans and AI agents.

Our **Model Context Protocol (MCP) server** is live and plugs straight into modern AI coding tools. Your agent can sign up, generate API keys, design a workflow, run test sessions, listen for webhooks, and check the results — all without you opening the console.

We've tested the full integration with **Claude Code, Codex, Cursor, Devin, Aider, and Replit Agent**. Every one of them completes the integration end-to-end. The canonical agent prompt is paste-ready on the [/developers](/developers) page.

Question 11

Where does my customer data live, and how is it protected?

Accepted Answer

**Production data is processed and stored in the European Union by default**, on Amazon Web Services. Enterprise contracts can request alternative regions for jurisdictions whose regulators require it.

**Encryption everywhere.** AES-256 at rest across every database, object store, and backup. TLS 1.3 in transit on every API call, webhook, and Business Console session. Biometric data is encrypted under a separate Customer Master Key.

**Retention is yours to control.** Default retention is indefinite unless you configure shorter — between **30 days and 10 years per application** — and you can delete any individual session at any time from the dashboard or the API.

The Data Processing Addendum, sub-processor list, and security policy are public at [/security-compliance](/security-compliance).

Ondato alternative — EU-deep, four product lines, no minimum

3 reasons why companies are switching from Ondato to Didit

82% cost savings

Instant onboarding

Fully modular

Ondato vs Didit, line by line.

Costs and Pricing

Commercial Flexibility

Integration Speed

Fraud Detection

Developer Experience

Connected data sources

Regulator attestation

Open a new country in one click. We do the hard work.

Start free. Pay per usage. Scale to Enterprise.

Free

Usage Based

Enterprise

Public pricing, line by line.

Switching from Ondato.

Infrastructure for identity and fraud.