Cloud-native Architecture
Context
The situation before the platform
Why regulated organisations needed one verification workflow instead of a scanned-document folder and three screening logins.
| The business |
Regulated organisations that have to verify people at volume — banks, lending companies, healthcare providers and other regulated industries — alongside the compliance teams inside them who own the KYC and AML process. |
| The starting point |
Identity verification was slow and fragmented. The organisations that need it most also deal with the highest volumes, so doing it manually produced delays, inconsistency and a compliance trail that often failed to stand up under scrutiny. |
| The trigger |
Cutting corners to keep up introduced regulatory risk instead of removing it. Compliance teams were doing the work but had no tooling to do it reliably at scale, and no evidence tied to the verification event itself. |
| What they wanted |
One full-spectrum flow from invitation through mobile sign-up, biometric face scan, government document verification and secure record creation, with AML screening — PEP checks, sanctions, criminal background, SSN and bank account checks — as a core configurable layer rather than a separate system. |
| Constraints |
KYC sits where compliance, security and user experience pull against each other · every step had to be traceable, tamper-proof and audit-ready · and the flow still had to stay frictionless enough to minimise drop-offs during onboarding. |
System
What it runs at today
The platform as delivered, live across mobile and web in everyday clinical use.
Completion speed
3x
Faster completion than the manual KYC processes it replaced
AML add-on checks
5+
PEP screening, SSN verification, criminal background, bank account and bank statement retrieval, configurable per invitation
Engagement length
12+
Months, as an enterprise engineering partnership through launch and scaling
Team size
6+
Designers, engineers and QA covering web, iOS, Android, backend and compliance logic
The engineering problem
Six compliance gaps that shaped the build from day one
Not vague pain points — the specific reasons spoken clinical detail was being lost, each paired with what we did about it.
0
1
An emailed ID photo reviewed by eye is not a compliance process
At any meaningful volume, manual KYC breaks down. Staff cannot keep up, errors creep in, and the audit trail is a folder of scanned documents with no real integrity behind it.
What we did
An invitation-driven workflow that carries the individual from email invite through mobile sign-up to a completed, structured verification record — the backend handles concurrent KYC flows and invitation state rather than a person handling each one.
0
2
A document does not prove who submitted it
Without liveness detection and biometric face matching, the process leaves a gap any serious fraudster can exploit. Most standard KYC tools were not built to close it properly.
What we did
A live face scan with liveness detection confirms physical presence, then the system validates document authenticity, checks expiry, runs OCR extraction and cross-matches the face to the document photo.
0
3
Screening results that never tie back to the identity
PEP checks, sanctions screening and criminal background verification each meant a separate system with its own login and its own record, and no clean way to attach the result to the identity just verified.
What we did
AML screening became a configurable add-on layer on the same record — assigned as tasks after the primary identity check, resolved against the same audit trail, with PEP result handling and an escalation flow for flagged individuals.
0
4
People started verification and abandoned it
Complex flows, unclear instructions and browser-based document uploads pushed drop-off up, leaving compliance teams to chase people who never finished.
What we did
A single-app journey from invitation to completion, with clear instructions and a logical step sequence. Every screen was tested against real drop-off points to find where people got stuck and why.
0
5
Evidence that could be altered, deleted or go offline
Completed verifications lived in a database that could be changed or a file that could be deleted. Nothing was bound to the verification event itself — which became a serious issue whenever regulators, auditors or legal disputes asked for proof of due diligence.
What we did
An Identity Verifiable Digital Token generated on completion and stored on-chain, recording biometric attestation, face match, document validation and authority confirmation in a form that cannot be modified afterwards.
0
6
A subscription customer treated like a financial counterparty
Most platforms offered a single fixed flow. Either low-risk customers were asked for more than was needed, or the relationships where depth actually mattered were under-verified.
What we did
Every invitation is configured independently. The organisation selects which add-on checks apply, so verification depth matches the actual risk of that specific customer relationship.
Architecture
How it fits together
Simplified — the shape rather than every service.
0
1
Clients
iOS • Android • React.js • Next.js • HTML & CSS
Two distinct journeys on purpose: a web dashboard where compliance teams manage invitations and track status, and native mobile apps where the individual actually completes biometric and document verification.
0
2
Gateway
Nest.js API layer • Phone-based authentication • Integration layer
A single API surface handles phone-based account creation, invitation state and every client request, with a stable integration layer isolating the core platform so a change in a screening provider does not break the whole flow.
0
3
Services
Biometric processing • Document verification & OCR • AML add-on routing • IVDT generation • Status tracking
Each concern stands on its own, so the synchronisation engine, record management, scheduling, billing and diagnostic handling can be tuned or extended without destabilising the rest of the clinical workflow.
0
4
Data & infra
PostgreSQL • Node.js • Valitorum & VDT storage • AWS
PostgreSQL holds application and verification state, while the on-chain layer carries the immutable record. Compliance research determined which verification events belong on-chain and which stay in the application layer.
State management between the web and mobile halves was designed before production code was written: a change in the mobile app has to be reflected on the dashboard immediately, because compliance teams act on that status.
Solutions
Six systems doing the actual work
Not a features list — the specific things we built behind every number above.
Invitation-driven onboarding
The organisation sends a KYC invitation from the dashboard — basic details, required add-on checks, documents needing consent and an optional agreement. The invited person receives an email with one action to take.
Mobile-first biometric verification
Sign-up by phone number, a live face scan with liveness detection, then a government ID — passport, driver's licence or international ID — validated for authenticity and expiry, OCR extracted and cross-matched to the face.
Configurable AML add-ons
PEP screening, SSN verification, criminal background checks, bank account verification and bank statement retrieval are selected per invitation and assigned as tasks once the core KYC is complete.
On-chain identity record
An Identity Verifiable Digital Token is generated on completion and stored on-chain, recording the verification event as portable, cryptographically secured proof the individual carries in their wallet.
Real-time status tracking
The dashboard shows where every invited individual stands — invited, in progress, verification complete, add-ons pending, rejected — and any change in the mobile app appears immediately.
Reusable identity across the ecosystem
A verified individual does not repeat full verification for every new organisation. Their identity can be shared selectively with explicit consent, cutting friction on repeat verifications.
Key features
What the platform does day to day
Five capabilities, each closing one of the gaps identified above.
| Capability | Runs | Refresh | What it does |
|---|---|---|---|
| Invitation management | Dashboard | On send | Compliance teams create invitations, select add-on checks, attach consent documents and an optional agreement |
| Biometric identity verification | Mobile app | Per session | Phone sign-up, live face scan with liveness detection, document capture, OCR and face-to-document cross-match |
| AML compliance screening | Configurable add-on | After core KYC | PEP, SSN, criminal background, bank account and bank statement checks assigned as tasks per individual |
| Appointment scheduling integration | Clinic staff | Calendar sync | Synchronise appointments with Google Calendar and streamline scheduling, calendar management and staff coordination |
| On-chain record & IVDT wallet | Blockchain layer | On completion | Timestamps and attests each verification event on-chain and issues a reusable token to the individual's wallet |
Integrations
How the moving parts plug in
Document verification, biometrics, compliance screening and the on-chain layer reach the platform through one integration layer rather than sitting beside it as separate tools.
Connected capabilities
Document verification
Authenticity, expiry and OCR extraction
Biometric processing
Face scan, liveness, face-to-document match
Compliance screening
PEP, sanctions, criminal background, SSN, bank
Cloud infrastructure
AWS hosting and delivery
↓
Through one stable integration layer ↓
Platform integration layer
Nest.js API layer
One contract for dashboard and mobile
Phone & consent authentication
Account creation, terms, biometric consent
IVDT generation
On-chain record at the verification event
↓
into the core services ↓
CORE SERVICES
Invitations
Identity verification
AML add-on tasks
On-chain records
Dashboard & reporting
Because identity verification and AML screening resolve against the same record and the same audit trail, a compliance team stops stitching together outputs from separate systems and works from a single coherent picture of each customer.
SECURITY
What makes the record hold up to audit
The platform handles biometric data, government documents and AML screening results — so integrity and access control were designed in, not bolted on.
Immutable on-chain verification records
Each verification step is recorded on-chain as it happens and cannot be modified afterwards, with cryptographic timestamps on every KYC session.
Biometric attestation on-chain
Biometric verification results are recorded and attested on-chain, so identity validation can be trusted rather than taken on the word of the storing system.
Decentralised AML screening logs
AML screening results are stored permanently on-chain, which keeps the compliance outcome transparent and attached to the identity it belongs to.
Consent-controlled identity sharing
A verified identity is only shared with a new organisation on the individual's explicit consent, giving people real control over their own identity data.
PROCESS
How we got there
Five stages, starting with what KYC and AML regulation actually requires rather than a feature list.
0
1
Discover
We mapped the full compliance context: what KYC and AML regulations require, what the team needed the platform to do, and how the journey had to feel to the invited individual.
0
2
Define
The platform was scoped in two halves — the organisation-facing web dashboard and the individual-facing mobile journey — with the handoff points and on-chain generation logic defined up front.
0
3
Design
The mobile onboarding flow went through significant iteration so face scan, liveness, document capture, payment and task completion worked on a phone without feeling like a government form.
0
4
Develop
Dashboard, iOS and Android apps, the biometric and document verification layer, the configurable add-on system and the IVDT generation logic, with web and mobile syncing status in real time.
0
5
Validate
We deliberately probed the failure modes regulators care about — failed liveness detection, partial document reads, payment failures mid-flow, add-on states after primary KYC completes.
BUSINESS IMPACT
What changed for the business
Beyond the headline numbers, three things compliance teams and verified individuals noticed first.
A verification process teams can point to
Every individual verified through a biometric, document-backed process, every compliance check logged on-chain, and every step traceable to a specific time and a specific person.
A better experience for the person being verified
A clear invitation, a guided mobile flow, and a completed verification stored in the individual's own wallet rather than only in someone else's database.
Identity that carries forward
The reusable token means users build a verified identity over time that they share on their own terms, while the receiving organisation still gets a compliant verification.
COMMERCIAL OUTCOME
What the engineering choices are worth in operating terms
Every headline number traces back to a specific decision, not a vague platform effect.
| ENGINEERING DECISION | OPERATING OUTCOME | MEASURED EFFECT |
|---|---|---|
| Invitation-driven mobile KYC flow | Verification completes in minutes on a phone instead of days of manual review | 68% less onboarding time |
| Automated biometric and document pipeline | Staff stop reviewing IDs by eye and start handling exceptions only | 3x faster than manual KYC |
| IVDT generation at the verification event | Audit evidence exists the moment verification happens, not when it is requested | 100% on-chain audit trail |
| Configurable AML add-on check system | Verification depth matches the risk of each customer relationship | 5+ checks per invitation |
STACK
What it's built on
The actual technologies, not feature names with icons attached.
Frontend
- React.js
- Next.js
- JavaScript
- HTML
- CSS
Mobile
- iOS
- Android
Backend & data
- Node.js
- Nest.js
- PostgreSQL
Blockchain & infra
- Valitorum & VDT storage
- Celero Payments
- AWS
FULL CASE STUDY
Get the complete write-up as a PDF
The same content on this page, plus the extended module breakdown and delivery phases, in a single document you can share internally.
- Full verification and AML screening architecture
- Full verification and AML screening architecture
- Full verification and AML screening architecture
Download the case study
No spam • unsubscribe anytime • we’re here when you need us
More work
Other platform builds
Hospitality
Every stay, extraordinary.
Hospitality group transformed guest experiences through IoT-enabled room automation, reducing service requests by 58%
Hospitality Group transformed Guest Experiences through IoT-enabled Room Automation, reducing Service Requests by 58%
IoT - Hospitality
Read the case study →