hckrnws
Launch HN: Didit (YC W26) – Stripe for Identity Verification
by rosasalberto
Hi HN, I’m Alberto. I co-founded Didit (https://didit.me) with my identical twin brother Alejandro. We are building a unified identity layer—a single integration that handles KYC, AML, biometrics, authentication, and fraud prevention globally. Here’s a demo: https://www.youtube.com/watch?v=eTdcg7JCc4M&t=7s.
Being identical twins, we’ve spent our whole lives dealing with identity confusion, so it is a bit of irony that we ended up building a company to solve it for the internet.
Growing up in Barcelona, we spent years working on products where identity issues were a massive pain. We eventually realized that for most engineering teams, "global identity" is a fiction—in reality it is a fragmented mess. You end up stitching together one provider for US driver's licenses, another for NFC chip extraction in Europe, a third for AML screening, a fourth for government database validation in Brazil, a fifth for liveness detection on low-end Android devices, and yet another for biometric authentication and age estimation. Orchestrating these into a cohesive flow while adapting to localized regulations like GDPR or CCPA is a nightmare that makes no sense for most teams to be working on.
When we looked at the existing "enterprise" solutions, we were baffled. Most require a three-week sales cycle just to see a single page of documentation. Pricing is hidden behind "Contact Us" buttons, and the products themselves are often bloated legacy systems with high latency and abysmal accuracy.
We also noticed a recurring pattern: these tools are frequently optimized only for the latest iOS hardware, performing poorly on the mid-range or older Android devices that make up a huge percentage of the market. This results in a "leaky" funnel where legitimate users drop off due to technical friction and fraud goes undetected because data points are spread across disparate systems. Also, these systems are expensive, often requiring massive annual commits that price out early-stage startups.
We wanted to build a system that is accessible to everyone—a tool that works like Stripe for identity, where you can get a sandbox key in thirty seconds and start running real verifications with world-class UX and transparent pricing.
To solve this, we took the "delusional" path of full vertical integration. Rather than just wrapping existing APIs, we built our own ID verification and biometric AI models—from classification and fraud detection to OCR models for almost every language. This vertical integration is fundamental to how we handle user data. Because we own the entire stack, we control the flow of sensitive information from end-to-end. Your users' data doesn't get bounced around through a chain of third-party black boxes or regional middle-men. This allows us to provide a level of security and privacy that is impossible when you are just an orchestration layer for other people's APIs.
We believe that identity verification is one of the most critical problems on the internet, and must be solved correctly and ethically. Many people are rightfully skeptical, especially given recent news about projects that have turned identity into a tool for mass data collection or surveillance. We don’t do anything of the sort, but we also don’t want to be coerced in the future, so we facilitate data minimization on the customer side. Instead of a business asking for a full ID scan, we allow them to simply verify a specific attribute—like "is this person over 18?"—without ever seeing the document itself. Our goal is to move the industry away from data hoarding and toward zero knowledge, or at least minimal knowledge, verification.
The result of our all-in-one approach is a platform that increases onboarding rates while lowering identity costs. We’ve focused on building a high-confidence automated loop that reduces the need for manual review by up to 90%, catching sophisticated deepfakes and spoofing attempts that standard vision models miss. Our SDK is optimized for low bandwidth connections, ensuring it works on spotty 3G networks where legacy providers usually fail.
We are fully live, and you can jump into the dashboard at https://business.didit.me to see the workflow orchestration immediately. Our pricing is transparent and success-based; we don’t believe in hiding costs behind a sales call.
We’re here all day to answer any question—whether it’s about how we handle NFC verification, our approach to deepfake detection, the general ethics behind biometric data retention, or how we think about the future of identity. We’d love your brutal HN feedback on our APIs, platform, and integration flow!
Congrats on the launch! Hard to judge from just demo videos but the flow seems much nicer than those I’ve encountered in many apps.
A couple questions: 1. Given that one of your offerings is a wallet for identity, how do you handle storing user biometric data and documents 2. I’m surprised AI age detection based on faces is accurate enough to be used for account decisions. Is there any specific standard your models are held too and why would someone prefer it over an ID document proving age?
Great to see innovation in this space!
If I could make one giant request, it's around giving (properly authorized) humans the ability to override the system when needed. When you make a simple API, it's all too common for a company integrating the solution to rely entirely on the identity service's yes-no outcome. But all too commonly, there's no way to override a decision, or bypass the need for identification.
In the travel space, I've seen situations, especially with luxury and celebrity clients, where there's human levels of trust across the board, all parties are agreed at senior levels that they'd like to fulfill with a one-off exception to identity verification... but the technology refuses to let them proceed without going through the full verification flow, and if they're integrated in the simplest way, there's no "escape hatch" on the integration's side.
And similarly, if a person happens to trigger false negatives on video matches (say, due to medical reasons) giving support teams an ability to build exceptions is key. Having a way to tell the system "for this transaction/account ID, when they get to this node in the flow, let them through as if checks proceeded, or treat them as pre-authorized" would set you apart.
(Obviously, for things involving KYC, there's a lot of considerations around permissioning - but for many use cases, you want to empower senior support teams.)
This sounds innately wrong. When we think of celebrity clients traveling but skipping any identity checks because their entourage can vouch for them and don't want to hassle them - then who's to say later whether that person did or did not travel to that island or authorize that money transfer?
Instead, this should be handled not by fudging identity verification but by skipping it and maybe tagging the skip event with some verified identities of the people authorizing the skip.
This is a great point. In Didit you can already configure this kind of flexibility. For example, you can set rules like “if email/phone = X, skip ID verification” or route the user through a different flow.
We also built a case management system so support teams can manually review cases, approve/decline them, or override decisions when needed. Automation handles most cases, but humans can step in for the edge cases.
There are a bunch of competing companies in that space but it's true that transparent pricing and self-service is rare. Good idea to focus on that.
Thanks! transparency and frictionless access always wins long term
Suerte! Unrelated, growing up in Spain it always baffled me that identification was based on a photo on your DNI. Stories of siblings or even friends that had a passing resemblance to each other sharing DNIs was a common story.
Spain didn’t really integrate many of the newer innovations in identity verification for a long time. Luckily things are improving, and we’re already working with some great companies there. Saludos!
with all this talk about persona/discord sending identities to the dhs and everything, what steps do you guys take to keep identity information private?
I don't have the full context on the Persona/Discord story yet, but our philosophy is that identity providers should be a shield, not a source of risk.
We address this by building privacy-preserving architectures that minimize the data footprint. First, we offer secure, long-term retention so companies don't have to store sensitive PII on their own servers—which are often managed by teams who aren't cybersecurity specialists.
Second, and more importantly, we provide granular data control. Our customers can select exactly which fields they need to keep (e.g., just Name, DOB, and Country) and set the system to automatically purge sensitive assets like ID photos immediately after verification. It’s about ensuring that only the absolute minimum amount of data necessary ever exists in the system.
[dead]
Stripe has a pretty good identity system already. What do you think of it?
Stripe Identity is good, especially if you already use Stripe.
The main difference is that Stripe built identity mostly for their payments ecosystem, while Didit is a standalone identity infrastructure that works across any platform and any identity flow.
We also optimized heavily on fraud detection, speed, and much better pricing.
Isn't it useful to pair identity with common reasons to identify? Why else would you ask?
Are you saying your fraud detection and speed beats Stripe, or just your price?
Yes, we mog on speed, onboarding rate, fraud detection, and price.
> Yes, we mog English please
Didit?
I certainly didn't do it.
Who would you say is your primary competitor (besides Stripe) and how are you better than them today?
There is many direct competitors in the space, the main ones are Persona, Jumio, Incode, Sumsub, and even orchestrators like Alloy.
In general I believe we just built a better product:
- Fastest verification on the market (inference time < 2s, well optimized infra, we do real time checks (for example when you do the front scan of the ID, we do the checks real-time, instead of waiting for the user to do the back, like persona does, and takes > 30 s, ours is less < 2 s).
- Optimized onboarding rate worldwide, global coverage, any country, low connectivity and every device accepted, and optimized (different models loading in the client depending on the speed ..etc, and many more tricks)
- Fraud detection (we analize > 200 signals, to detect fraud in real time, from IP analysis, device fingerprinting, replay attacks, deepfakes ...) we got experts on that, and we act quickly if we see new attack vectors appear.
- Developer experience (self-service, pay per usage, API first). You can start doing verifications without needed to use the UI (everything programatic), and integrate in few minutes.
- Flexible, you can create any identity flow with your own rules. You can enable features with just 1 click, no need to reintegrate.
- Pricing model (pay per usage, no monthly minimums, no enterprise gated, and low prices)
Seon, Comply Advantage. There's lots of competition here.
Comply Advantage specializes in AML, Seon as well.
They provide one signal, identity verification is more than that.
“Stripe for XXXX” is an odd description when Stripe does the XXXX feature.
What do you guys do different?
(Stripe identity customer)
Stripe builds great products, including identity. But it’s not a specialized identity platform.
A few differences: - Limited global document coverage (not all IDs or countries supported). https://docs.stripe.com/identity - No advanced workflow orchestration for complex identity flows - Missing features like NFC chip verification - Pricing similar to traditional IDV vendors (expensive)
Stripe Identity works well inside the Stripe ecosystem, but companies that need more flexible, global identity infrastructure usually look for specialized solutions.
Here's a better idea: Eradicate requirement of the most personal details of someone to do basic tasks...such as using a web application.
Unless it's a government organisation, no private provider should have the ability to use or process people's identities. It's too much power in one entity's hands. I wish someone would actually solve this instead of yet another ID solutions. We all saw how a literal job seeking app (LinkedIn) abused this.
We actually agree with the core concern.
Right now the internet has a terrible model where every company asks for your ID and stores it themselves. That means your identity data ends up scattered across dozens of databases.
We think the future is privacy-preserving identity and reusability: verify once, keep your identity in your own wallet, and only share minimal proofs (e.g. “over 18” or “real human”) instead of your full identity every time.
That’s the direction we’re building toward with SSI / identity wallets and reusable verification.
Id say this is a valid criticism of the b2c market (esp. for social networks). but there still is a viable b2b market where kyb/c is not as intrusive - and sometimes a regulatory requirement (finance, health, etc.).
These 'identity verification' companies end up becoming a main enemy of this pursuit. Their own revenue relies on legislation that assures their existence.
[dead]
Nice to see a Spanish startup in YC :) Good luck!
thanks! Spanish founders mog!
[flagged]
Personal attacks are not allowed here. No more of this, please.
[dead]
[dead]
Crafted by Rajat
Source Code