MerlinID
Coming soonAge verification that keeps nothing it doesn't need
Check that somebody is old enough — by face, by estimate, or against their ID — and keep the answer rather than the evidence.
What it is
Keep the answer, not the evidence.
The law increasingly wants you to know how old your users are. The usual way to find out is to collect a face and a government document — and then to be responsible for them forever. MerlinID does the checking and hands you back only the result.
Face liveness
Confirms there's a real person in front of the camera rather than a photograph of one.
Age estimation
Estimates an age range from that same face. For a great many sites, comfortably over the line is all the certainty the question needs.
Document matching
When you need to be sure, an ID document is read and matched against the face. Reserved for when estimation isn't enough, because it asks a lot more of the person.
A screening is born with an expiry under twenty-four hours, and a sweep runs every hour destroying everything past it — the face capture and any document go with it, leaving a log entry recording that the deletion happened. What survives is the answer and the proof a check took place. That is the entire point: a breach of MerlinID should not be a breach of anybody's face or passport, and the surest way to manage that risk is to not be holding the material.
The face and the document are read by Amazon's Rekognition and Textract, which is where the liveness, the age estimate, the match and the document parsing actually happen. We are honest about that rather than implying we built the computer vision ourselves — and it is our privacy policy that says so, on the company's own domain, alongside everything else we run.
How it fits
Two server calls and a redirect.
No SDK to adopt and no JavaScript to trust. Your server asks for a screening, sends the person to us, and asks for the result when they come back. JSON in, JSON out, in any language.
-
1
Create a screening
Your backend posts to /screenings with a bearer key. We return a token and a URL.
-
2
Send them to us
Our hosted pages handle liveness, estimation, and any document step.
-
3
They come back
We redirect to your callback with the token and your own CSRF state — no claims in the URL.
-
4
Fetch the result
Your backend gets /screenings/:token/result.json and receives the claims as JSON.
- Hosted in
- Montreal, Canada
- Aligned with
- GDPR, UK GDPR, PIPEDA
- Built for
- Ofcom age assurance
Where it's up to
Working, not yet selling.
The verification flow runs end to end and there's a Rails engine for dropping it into an app. What isn't finished is the part where you can sign up and pay for it yourself, so for now it goes out one customer at a time.
We built it because our own communities needed age assurance and we didn't want to hand that job to a company that keeps the documents. If you have the same problem, we'd like to hear how you're solving it.
Who runs it
The same small company, on the same pager.
MerlinID is built and run by Eadiefleet, a small family run software company in London, Ontario. It bills on its own and runs on its own, but it is covered by one set of policies with everything else we make, and when something breaks you reach the people who wrote it.
- Runs on
- Web API
- Status
- Coming soon
- Other products