Entrust Identity Verification: Onfido verification, workflow orchestration and authentication

Entrust Identity Verification is the current name for the former Onfido verification offering. It combines document and face checks, external data, fraud signals and Workflow Studio orchestration. A financial firm can use the components at account opening and at later identity-sensitive steps, selecting the checks and decision paths appropriate to that journey. Smart Capture supplies the document and biometric capture experience.[1]

Document checks can move to manual review where an image is difficult to assess or the document presents more complex fraud indicators. Manual review can also be configured for every document check, with asynchronous results delivered through webhooks. For supported chip-based documents, NFC capture through the mobile SDK validates cryptographically signed data; successful NFC capture changes which normal visual checks are performed. The customer can restrict acceptable document types and issuing countries.[3]

A Watchlist report returns clear when no match is found and consider when one or more matches are returned. Its records carry the matched entries, and the available fields depend on the underlying information. The distinction between Standard and AML is therefore substantive: the AML variant adds adverse media to the other categories. A report result is a screening output to review, rather than an assertion that a person has committed an offence.[5]

Biometric enrolment and authentication can form part of an onboarding workflow or be invoked later using an existing reference. The documented on-device flow first verifies a person through document and biometric checks and then stores encrypted biometric information on the device. A later flow compares a new capture with that reference. This supports verifying the returning person without repeating every original onboarding step.[6]

API v3.6 supports scoped, short-lived OAuth access tokens lasting 60 minutes, with an optional IP allowlist for each OAuth application. Server credentials and SDK tokens have different roles. Regional environments provide storage at rest in the EU, US or Canada; the EU environment uses Ireland with backup storage in Germany. The selected regional endpoint and credentials must agree.[9]

Webhook consumers should acknowledge delivery with the documented HTTP 20x response within ten seconds. Failed delivery is retried five times, ending ten hours after the first attempt; notifications can be duplicated or arrive out of order. The integration therefore needs repeat-safe processing of each workflow result.[9]

The signature-verification guide specifies HMAC-SHA256 using the webhook secret and the original request body, compared against X-SHA2-Signature with a constant-time comparison. Parsing and reconstructing the JSON before checking it can change the byte sequence. Entrust recommends the verification support in its client libraries where available. This provides a concrete origin check before the broker acts on an incoming result.[10]

The named Microsoft Entra Verified ID and Okta Workforce Identity integrations address employees and workforce account management. In the Okta flow, Okta determines when verification is needed, Entrust verifies the person and Okta applies the result. That scope is separate from the customer-account workflow built through the verification API and SDK.[2]

Entrust directs identity-verification buyers to a product discussion and an order defining the purchased checks and services. The public product page does not present a universal per-verification tariff. The selected verification products, ongoing authentication and implementation package therefore need to be priced as the intended journey, rather than inferred from another Entrust product’s subscription.[2]

Under the general subscription terms, cancellation notice is due at least 60 days before term-end. Renewal duration and charges follow the renewal reminder or quote; absent either, the default is one year at the then-current list price. Purchases through a partner use the partner’s agreed fee and tax terms.[15]

Sandbox requests return predefined results and are not charged; confidential and personal data must not be uploaded there. Live requests require valid billing information. The integration creates an applicant, calls a valid active workflow and launches the capture journey. Live video and motion uploads require an Entrust SDK, while direct API media upload supports a narrower set of inputs.[11]

Classic checks and Workflow Studio runs can coexist in the same account and use the same applicant, but they remain independent. New verification features are developed for Studio, while existing Classic integrations remain supported. Migration changes the creation and retrieval endpoints, the SDK initialisation and the completion event to workflow_run.completed. Studio requires API v3.4 or later, and individual tasks impose their own minimum SDK versions.[12]

Studio saves workflows as versions. Activation controls the version used for new runs, and gradual rollout can divide traffic between two variants. Output fields need explicit mapping to the result tasks on each route; invalid mappings block activation. These controls let a team introduce a changed check or decision branch while keeping the downstream data contract visible.[7]

From API v3.6, compatible additions such as new response fields or enum values can enter the current minor version. Breaking changes require a new minor version. Client libraries are versioned separately, so maintaining a robust parser and tracking the library/API combination are continuing integration tasks.[13]

The IDV schedule requires maintenance releases to be installed within nine months.[14]

The support terms ask for reproducible examples, screenshots and enough context to investigate the incident. The current support route is the Identity Security Experience Portal, and the developer guide publishes [email protected]. Service-status subscriptions provide a separate route for incident updates.[17][28][11]

The SLA uses commercially reasonable efforts and a 99.5% uptime target. Report targets start 30 days after the first live check and run only once all required inputs and initiation requests have arrived, until the completion response. Monthly measurement depends on the specified volume forecasts and baseline tolerance. Chinese, Russian and Japanese document/facial checks instead use a 99%-within-24-hours target. Maintenance, external-provider performance and events outside Entrust’s control have exclusions.[16]

The operator is Entrust Corporation or the affiliate identified in the order. This is an identity-verification service contract. The IDV schedule leaves the customer responsible for its workflows and conclusions and says the service should not be the sole basis for a business decision.[15][14]

The product-specific terms impose additional boundaries on particular modules. Authentication Motion is for re-authentication following separate initial biometric verification. Australian DVS checks require the customer’s onboarding form, approval through the applicable government process and express user consent; eligibility includes lawful operation in Australia or New Zealand. Ongoing watchlist products may require rolling deletion to be disabled at account level. These conditions attach to the purchased modules.[19]

The September 2026 product privacy notice distinguishes processing on the customer’s behalf from Entrust’s own controller processing. The latter includes fraud prevention and service development or improvement using analytics, machine learning and AI where permitted. Customer-configured service retention remains subject to legal and product limits. For Known Faces, Document Known Faces, Authentication Motion, Face Authentication, Biometric Passkey and Liveness Verification, stored face scans have a maximum of 365 days from submission of the source image or video.[20]

For relevant US biometric services, the additional terms require notice and consent before biometric data is captured, confirmation to Entrust and retention of the consent record for at least seven years. The technical consent guide separately makes supplied consent valid for twelve months before it must be provided again. Keeping evidence of consent and refreshing operational consent are therefore distinct controls.[24][25]

The processor DPA requires notification without undue delay after Entrust confirms an incident affecting customer personal data. Customers can subscribe to subprocessor-change emails and object within ten business days of notification. If a reasonable objection cannot be resolved within the specified period of up to 90 calendar days, the affected services can be terminated. This gives the customer a defined escalation route for a processing change.[23]

Entrust completed the Onfido acquisition on 9 April 2024. Onfido was founded in 2012, and its identity-verification technology became part of Entrust’s wider identity-security portfolio. The continuing Onfido hostnames, SDK references and historical contractual names reflect that product lineage. Current customer-facing branding calls the offering Entrust Identity Verification; the broader company also operates separate identity-access, card-issuance, encryption and signing products.[27]

A further deployment distinction appears in the June 2026 product terms: the Biometric Passkey server component can be customer-hosted or installed on premises. Its customer-controlled environment carries separate software and support conditions, including responsibility for configuration, infrastructure and third-party dependencies. That option relates to the passkey component and should not be read as an on-premises version of the entire hosted verification service.[19]

Operator

Entrust Corporation or the contracting affiliate identified in the order

Service scope

Document, biometric, data and fraud checks, workflow orchestration and subsequent authentication.

Customer types

Financial institutions; Digital platforms; Enterprises; Government organisations

Delivery

SaaS; API; Hosted

Pricing publication

Quote only

Platforms

Workflow Studio; Smart Capture; Entrust Dashboard

Integrations

REST API; Web/mobile SDKs; Signed webhooks; Smart Capture Link

Pricing scope

Order-based verification and module pricing; subscription-user overages apply where that model is contracted.

Implementation

SDK or hosted-link capture, API integration, sandbox testing and optional advisory onboarding packages.

Support

Identity support portal, client-support email, incident priorities and verification-specific service targets.

Permissions and regulatory scope

Identity evidence and workflow tooling; customer decisions and product-specific consent and evidence duties remain.

Provider metadata checked 20 Oct 2026Source 1Source 28Source 26Source 15Source 8Source 18Source 2Source 11Source 14Source 10

The deletion guide describes a standard combined retention ceiling of three years/1,095 days, while identifying separate object-lifetime subscription records, fraud-data settings and possible longer regulatory-retention arrangements. Hard deletion removes the ability to recover the applicant or investigate its results; backup, logging and subprocessor copies follow separate recorded procedures.[22]

For US users, the facial-scan policy distinguishes biometric data from source media: biometric data is held for at most 365 days from submission, or the customer’s shorter period; photos and videos can be held for up to three years from submission. Partially completed captures have their own three-year clock from termination of that process. Law or legal process can require further retention.[21]

ETSI-specific contract terms require the customer to download evidence files and retain them under applicable local obligations, as well as use compatible documents and obtain user acceptance. Separately, the processor DPA provides for written requests after contract termination to return, anonymise or destroy personal data under the relevant product procedures, subject to legal and claims-retention exceptions.[26][23]

Termination ends the right to use the offering and requires deletion of software copies; it does not refund prepaid fees or cancel unpaid fees. Evidence exports and retention instructions therefore belong in the operational handover before access ends.[15]