Jumio: identity verification, reusable identity and ongoing fraud signals

Jumio supplies identity verification and fraud controls for digital customer journeys. Financial-services use cases include remote onboarding, returning-user authentication and screening during the customer relationship. Wealth managers, banks, payment businesses and other financial firms can combine these checks with their own account-opening and risk policies.[1]

The platform connects verification services, external risk signals, scoring and rules within an orchestrated workflow. This matters operationally because a broker can request different evidence at first registration, a later account change or a new risk event, while keeping the resulting transaction linked to the same customer context.[2]

selfie.DONE starts with liveness and can reuse an eligible previously verified identity. It requires Premium Liveness, ID Verification and permitted biometric and identity-data lookup. Web and Mobile SDK capture are supported; direct API capture is not. Searches remain within the tenant’s Accepted IDs configuration. The person must confirm reuse and can choose a new scan. Missing data, no suitable match or detected risk also triggers a fresh identity-document scan.[3]

The current AML capability distinguishes matching profiles from a completed clean search and from screening that could not run. A matching profile produces a Warning; missing inputs, invalid settings or technical failures can produce Not Executed. The standalone route requires first and last names, with date of birth and country available as additional inputs. These outputs let the customer route a possible match for assessment instead of treating a technical failure as a successful screen.[7]

Jumio Watch can react to fraud findings on a connected transaction, a Jumio audit or customer feedback. Support or the account manager enables the service, and an administrator chooses which Portal users receive email or interface alerts. The published daily summary cadence is distinct from the result notification for a newly processed verification.[8]

Backend calls use OAuth 2.0 bearer tokens and the endpoint for the account’s US, EU or Singapore region. Tokens last 60 minutes by default. Basic authentication is used to obtain a token, not as the direct authorization method for subsequent REST requests. Transaction-specific tokens authorize particular upload and finalization operations and are not interchangeable with the main access token. Jumio instructs customers to keep client credentials on the backend.[10]

A callback URL can be configured globally or overridden for an individual account request. Jumio sends JSON by HTTP POST; the documented handling is to save the notification, return 200 OK and retrieve the relevant result. Regional source-IP and hostname allowlists support origin checking. Acquisition Started and Acquired notifications require activation through Support, so an integration should not assume those intermediate events are enabled.[11]

On AWS Marketplace, 25,000 Jumio Go transactions cost USD 37,500 for 12 months, using the linked terms’ default currency.[14][15]

That is a calculated USD 1.50 per included transaction if the full allowance is used, rather than a universal pay-as-you-go tariff. Additional AWS infrastructure costs may apply.[14]

Although the listing permits cancellation without refunds, the linked terms preserve noncancelable payment obligations.[14][15]

Linked April 2024 v7.2 terms allow Sales Order overrides.[15]

Support is a separate service choice: Standard, Advanced and Premium add different response and onboarding entitlements. The public plan comparison gives those differences but no common monetary tariff.[21]

Setup begins with the Jumio account manager, the required workflow keys and configuration in the Portal. API credentials and tenant settings must be available before integration, and the environment must support Jumio’s documented TLS configuration. This account and workflow preparation is separate from embedding the customer-facing capture screens.[16]

Workflow Designer provides reusable global workflows and custom workflows built with a Solutions Engineer. A workflow combines service steps, risk signals and conditional decision paths. Its design can therefore change both which evidence is requested and how the resulting signals are handled, rather than merely changing the wording of the onboarding screen.[17]

Saving a workflow leaves it in Draft; publishing activates it for transactions. The designer supports version tracking and JSON configuration download/upload. Importing an existing configuration creates a new workflow key, which must be reflected in the calling integration. This is a configuration-transfer facility, separate from transferring historical customer records.[18]

A dedicated mock tenant produces synthetic transaction outcomes for testing the customer’s decision logic. Support or the account manager configures that tenant; all transactions initiated there use the mock service. The requested decision is supplied through the customer reference payload, allowing rejection and exception paths to be exercised without relying on finding a real document that produces each outcome.[19]

Netverify is the legacy v2 product family. Moving to the Jumio Platform requires new API and SDK integration, while Support can migrate historical transaction data. The migration guide says migrated records remain accessible through both the old and new interfaces. Deleting a migrated transaction through the Netverify API also removes it from the Jumio Platform; maintaining two interfaces does not create an independent backup.[20]

The regional Health Check API separates overall status from API, callback, mobile, processing, retrieval and web components. It returns Up, Degraded or Down states. This lets an integration distinguish an acquisition problem from a result-retrieval or notification problem when deciding how to handle an interrupted customer journey.[22]

Jumio’s Online Services Privacy Notice describes controller processing and some customer arrangements where it acts as processor. It permits service improvement using machine learning and says automated checks inform the customer, while Jumio does not make the final decision producing legal or similarly significant effects. The verification result therefore feeds the financial firm’s own acceptance and compliance decisions.[24]

Default Web Client and SDK interfaces include consent handling. With direct API uploads, the customer must present the required notice and obtain consent before sending credentials. Even where Jumio is a processor, the documented US biometric API route still requires the consent object. Retrieving the recorded consent details in workflow results is an additional tenant setting enabled by the account manager or Support.[23]

Operational interpretation matters. The business-logic guide says a usability rejection can mean unsuitable images rather than fraud. It also states that expired documents do not produce a Warning by default; that behaviour must be configured. Optional ruleset mapping exposes reasons in the top-level response, while otherwise the customer must inspect the individual capability results. A rejection in one capability can reject the overall transaction.[25]

In its September 2026 security statement, Jumio describes least-privilege access controls, centrally recorded production access and data movements, and 24-hour monitoring. It also states that it maintains SOC 2, ISO 27001 and PCI DSS assurance. These are provider-published security representations; the referenced audit reports are not part of the public evidence inspected here.[26]

Jumio Corporation is the seller identified in the AWS listing.[14]

Jumio’s April 2026 announcement appointed Mark Lorion as chief executive. Bala Kumar, who had served as interim chief executive, continued as president and chief product and technology officer. The company identified Sunnyvale, California, as its headquarters and named Centana Growth Partners, Great Hill Partners and Millennium Technology Value Partners as backers.[27]

Operator

Jumio Corporation; contracting entity follows the Sales Order

Service scope

Identity, biometric and supporting-document verification; authentication, risk orchestration and AML screening.

Customer types

Financial-services firms; Wealth managers; Banks; Payment businesses; Digital businesses

Delivery

SaaS; API

Pricing publication

Public and quoted pricing

Headquarters

Sunnyvale, California, United States

Platforms

Jumio Platform; Jumio Portal

Implementation

Workflow and tenant setup, Web/SDK or API integration, callback handling and separate result retrieval.

Support

Tiered technical support through the Support Portal; published initial response times depend on plan.

Permissions and regulatory scope

Identity and risk technology supplies evidence for customer decisions; this profile does not describe a brokerage or execution service.

Provider metadata checked 20 Oct 2026Source 27Source 1Source 9Source 25Source 14Source 20Source 2Source 21Source 15

The online-service notice gives a separate biometric ceiling: normally three years from first providing images or videos, subject to shorter law. For processor arrangements, the ceiling is the earlier of the customer’s relationship with Jumio ending or three years after the customer informs Jumio that its last interaction with the person has occurred. Shorter legal periods still apply. Other processor retention follows customer instructions.[24]

Portal reports allow selected fields and filters, then become downloadable when generation succeeds. The Retrieval API also supports a transaction PDF through a presigned download URL. Those facilities serve different record needs: a filtered operational report and a particular verification’s supporting record.[28][32]

The Enhanced Reporting guide describes an APAC beta with reusable templates, scheduled reports and role-level permission to view or download personal information. Its stated regional beta scope should be retained when planning report automation; the page does not establish worldwide availability of those enhancements.[29]

Under the linked terms, Portal access is revoked at termination. Required records must be downloaded beforehand.[15]