DeepGuard
Star Get started
Open source · MIT · Self-hosted

Run your own identity-verification stack. No per-lookup billing.

DeepGuard verifies identity documents end-to-end: forensic image analysis, OCR and MRZ parsing, face matching, liveness detection, and AML screening — then returns a weighted verdict through a signed webhook. One container. Your data stays yours.

View on GitHub See the pipeline
MIT license, free forever No cloud dependency — runs in Docker 39 tests, 31 endpoints, day-one ready
$ git clone https://github.com/jordansoftware/DEEPGUARD-KYC
$ cd DEEPGUARD-KYC && docker compose up -d
# backend on :8765 · dashboard on :5173 · demo key: dg_demo
$ curl localhost:8765/api/kyc/cases -H "X-API-Key: dg_demo"
→ 200 OK · 8 seed cases · verdicts · heatmaps
The engine

Every layer of identity verification, in one container

Six analysis stages run on every document. Each contributes a weighted signal to the final verdict — so you audit why, not just what.

Forensic document analysis

Pixel-level forensics built to catch deepfakes, screen captures, and printouts: moment enhancement, error-level analysis, noise-pattern analysis, and EXIF chain inspection — rendered as heatmap overlays your analysts can actually read.

MELAELANoiseEXIFHeatmap

OCR + MRZ extraction

DocTR-powered text extraction and Machine Readable Zone parsing across 140+ document types — passports, national IDs, and driving licences.

DocTRISO 18013MRZ

Face matching

DeepFace 1:1 matching between the document face and the live capture, with cosine similarity and a configurable threshold per integration.

Liveness detection

Passive liveness cues — photometric consistency, skin texture, and ambient-light checks — to block printed photos and replayed video.

AML & sanctions screening

Fuzzy-name screening against OFAC SDN, UN, and EU lists with weighted risk scoring baked into the decision engine.

Multi-tenant API keys

Keys are per-tenant, SHA-256 hashed, rotatable, and revocable — manage them from the dashboard or straight through the API.

RotateRevokePer-tenant

Signed webhooks

Every case completion is delivered as an HMAC-SHA256-signed webhook with automatic retries and SSRF-protected target validation. Your backend stays in sync the instant a verdict lands — no polling required.

HMAC-SHA256RetriesSSRF protection
How it works

From ID photo to verdict in five stages

Your app submits the document. The engine evaluates it. You get a machine-readable verdict plus a human-readable audit trail.

01

Submit

POST /api/kyc/cases with the document and your API key

02

Forensics

MELA / ELA / noise / EXIF analysis with heatmap output

03

Extract

OCR + MRZ parsing pulls names, DOB, and doc numbers

04

Verify

Face match, liveness, and sanctions screening in parallel

05

Decide

Weighted engine scores signals → verdict + webhook

Case verdict

PASS
0.94 confidence score
KYC-9F3A · ID-FR
0.0threshold 0.71.0

All weighted signals cleared their thresholds. No fraud indicators, no sanctions match, face and liveness verified. The same payload is delivered as a signed case.completed webhook.

KYC-4B21-0DE8 ID-DE · Marc Le Guen
confidence0.58
Review
KYC-77AC-1B0F ID-MA · Yacine Belhadj
confidence0.21
Reject

Defect weights · KYC-77AC-1B0F

4 flags
MELA anomalymela_score +0.28
Screen-capture banding across the photo region.
Liveness cue weakliveness_cues +0.19
Photometric consistency below threshold — replay risk.
EXIF chain breakexif_anomalies +0.14
Creation timestamp post-dates document issue date.
Sanctions proximitysanctions_match +0.30
Fuzzy match to OFAC SDN at 92% similarity. Hard block.

Webhook delivery

HMAC-SHA256
case.completed 200 · 34ms
case.completed retry 2/5 · 429

Decision formula

weighted
verdict = Σ( defect × weight )
// reject when total > 0.6
face_missing +5 · not_mobile +2
defect weight pass threshold 0.7
31
API endpoints
39/39
Tests passing
140+
Document types
1
Docker compose up
Who it's for

Built for teams that can't send their users' data to a third party

DeFi · Crypto on-ramps

Self-custody KYC

Verify depositers and wallet operators without shipping PII to Sumsub or Onfido. Screening and forensics run on your own infrastructure, in your own jurisdiction.

Fintech · Lending

Compliance without the per-lookup fee

High-volume lending and remittance teams hit vendor pricing walls fast. DeepGuard is flat-cost: it runs wherever you do, scales with your traffic, and the verdicts are fully auditable.

Platforms · Marketplaces

Seller & creator verification

Drop face-match + document forensics into onboarding for sellers, drivers, or creators. The signed webhook keeps your backend in sync the moment a verdict lands.

FAQ

Questions we get a lot

Is DeepGuard a replacement for managed vendors like Onfido or Sumsub?
Yes, functionally — it's the self-hosted equivalent. The trade-off: you own the infrastructure, updates, and scaling. What you gain: zero per-lookup cost, data sovereignty, and full access to every model output and score, not just a final flag.
Who initiates the face-verification step?
Your app does. You call the face-session endpoint, show the returned QR code in your UI, and the end user scans it on their phone to submit a live selfie. The admin dashboard is view-only by design — it displays match, liveness, and device results but never initiates the flow.
Can I plug in my own sanction lists or screening rules?
Yes. The decision engine is a weighted rule system with exposed weights and defect definitions. Sanction lists load through the screening service; rule defaults live in /api/rules/defaults and are editable at runtime.
How is my API key secured?
Keys are SHA-256 hashed before storage, per-tenant, and rotate/revoke from the dashboard. Requests are authenticated via the X-API-Key header. Rate limits and SSRF protection are on by default.
What about GDPR and data residency?
Since everything runs in your own VPC or on-prem, data never leaves your network boundary. Export endpoints let you hand your users their data on request; retention is entirely your policy to enforce.

Own your verification stack

Clone it, run the container, generate a key. Your first verified case is minutes away.

Star on GitHub Read the full docs