Applicant → Orchestrator → Document vendor → Liveness vendor → Face-match vendor → Screening vendor → Decision
Authenticity depends on whichever liveness vendor was routed. Nothing in the orchestrator scores it the same way across paths.
eKYC orchestration / NeuroVerify
Deepfake Detection API for eKYC API Orchestration
Orchestration layers route each applicant through a changing mix of document, liveness, face-match and screening vendors. A deepfake can pass whichever vendor a given journey happens to use. NeuroVerify adds one consistent authenticity check on the selfie, in the layer you already control.
It plugs into the orchestration step as another call on media you already hold: no new step for end users, and one unified risk score with signal-level evidence.
NeuroVerify does not replace your vendors, routing rules or policy. It adds a vendor-independent authenticity signal that the rest of the workflow can use.
Powered byNeuroVerifyExplore the product
- #1 of 36on the public VendorBench-100
- <200 msp95 on eligible image requests
- 6 → 1six checks, one unified score
- 0new steps for your customer
The gap
Each vendor checks its own slice, and none owns authenticity.
Orchestration lets teams mix vendors by country, risk tier or cost: one for documents, another for liveness, another for face match, another for watchlists. That flexibility is the point. It also means no single vendor sees the whole journey or is responsible for asking whether the selfie is real.
Liveness vendors differ in what attacks they detect. Routing changes can silently change coverage. A journey that goes through one liveness provider today may go through a different one tomorrow, and a deepfake that one misses may pass the other.
Where the gap opens
A consistent check in the orchestration layer gives you one authenticity signal, whichever vendors sit behind it. See Integrate Neural Defend Into Existing KYC Stack.
Threats
What orchestration alone does not catch.
These are attack techniques, not claims about any specific platform. Each exploits the fact that the selfie is checked differently, or only partially, along different routes.
01
Probing for the weakest route
Attackers retry with different devices, countries or products until the orchestrator routes to a vendor that misses their deepfake.
02
Face swap that follows liveness prompts
A live face swap responds to blink and turn challenges, so prompt-based liveness at any vendor can pass. See Presentation Attacks Against Face Verification.
03
Injected video past one vendor's SDK
A virtual camera feeds video into a capture flow. Coverage of injection varies by vendor and SDK version. See Digital Injection Attacks.
04
Synthetic face reused across clients
One generated face is used in many applications through different downstream clients, so no single client sees the pattern.
05
Fallback paths with weaker checks
When a primary vendor times out, a lighter fallback runs. Attackers learn to trigger it.
06
Replay of captured sessions
A previously captured genuine session is replayed to a vendor that does not bind the media to this attempt. See Replay Attacks in Identity Proofing.
Regulators increasingly look at how institutions manage third-party and ICT providers. See DORA Procurement for Media and Identity Services.
A consistent authenticity signal supports your vendor governance. Your policy decides how to use it.
Where NeuroVerify fits
One authenticity check, placed once, applied to every route.
NeuroVerify sits in the orchestration layer after selfie capture. It can run in parallel with or ahead of the vendor routes, so the same score reaches your decision engine however a journey was routed.
Orchestrator → Document → Liveness vendor (varies) → Face match → Decision
Authenticity coverage depends on the chosen route.
Orchestrator → Selfie → NeuroVerify risk score → Vendor routes → Decision with evidence
One vendor-independent signal on every path.
What runs in the request
Six signals run in one request: Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance. You get one unified risk score with signal-level evidence. See NeuroVerify and Technology.
What stays with you
Your routing rules, vendor contracts, decision engine and policy stay with you. NeuroVerify supplies authenticity evidence. You decide what to do with it.
NeuroVerify Unified Trust LayerSix parallel analysis layers
- Visual Safety Screening
- Live Presence Verification
- Face Manipulation Detection
- AI Generative Model Analysis
- AI Pixel-Level Manipulation
- AI Content Compliance
Add a node after selfie capture
Insert NeuroVerify as a step in your orchestration workflow, using a backend SDK or the REST API on the selfie you already hold.
Read the unified score
Receive one risk score with signal-level evidence, typically under 200 ms p95 for eligible image requests.
Feed your decision engine
Pass the score into the rules that already combine vendor results, and set thresholds by client or risk tier.
Log it with vendor results
Store the evidence beside each vendor response for audit, tuning and vendor comparison.
What you get
What orchestration teams get.
Consistent coverage across routes
The same authenticity signal applies whichever vendors a journey is sent through.
Vendor flexibility preserved
You can swap or add liveness, document or screening vendors without changing the authenticity layer.
One integration, many journeys
A single node serves every journey and client type that shares your selfie step.
Better vendor comparison
Independent scores next to each vendor's own result show where checks disagree.
Evidence in your logs
Signal-level evidence supports tuning, audit and client conversations.
Deploy to match your clients
Managed cloud, private cloud or customer VPC, secure container, on-premises or air-gapped.
Questions
What teams ask before they integrate.
Where does NeuroVerify sit in an orchestration workflow?
Typically as one node after selfie capture, before or in parallel with the vendor routes. It uses the media your orchestrator already holds. No change is needed on the end-user app.
Will it conflict with our liveness vendors?
No. It does not replace them. It runs beside them and returns its own unified score, so your rules can compare or combine the two.
How hard is it to integrate?
Most teams send the media they already capture. There is no new step for the end user. NeuroVerify offers native mobile SDKs (Android/Kotlin, iOS/Swift, Flutter), backend SDKs (Python, TypeScript/Node.js, Go, Java), a REST API and an MCP server for AI agents.
Integration is two lines of code, and teams can be live in under 24 hours. That is a product claim; your timeline depends on your own change process.
How fast is it?
NeuroVerify targets under 200 ms p95 on eligible image requests, measured under defined test conditions. The test methodology is available on request, so you can compare it with your own latency budget.
Video and audio checks take longer than image checks. Share your media types during evaluation and we will confirm the expected timings.
Where can it be deployed, and how is data handled?
NeuroVerify can run as a managed cloud API, in a private cloud or customer VPC, as a secure container, on-premises, or air-gapped. Pick the option that fits your security review and data-residency rules. See Deployment and Product data handling.
Neural Defend holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certifications, shown on the Trust page.
Can we test it on our own media first?
Yes. We recommend evaluating on your own captures, including real customer media and the attack types you worry about most. Use your own acceptance criteria rather than a vendor demo set.
For context, NeuroVerify ranked first of 36 systems on VendorBench-100, with a detection score (MCC) of 0.876 against 0.646 for the next-best vendor. Read How to Evaluate Deepfake Detection Vendors for a checklist.
Who makes the final decision, and what about false positives?
You do. NeuroVerify returns one unified risk score with signal-level evidence. Your own policy decides what to approve, send to review or block. No detector is perfect, so set thresholds against your own risk appetite and review volume.
Because the evidence is signal-level, reviewers can see why a case was flagged instead of facing an unexplained score.
Evaluate NeuroVerify
Add one authenticity check to every route.
Send us selfie media from your orchestrated journeys and compare the unified risk score with what your current vendors return.