4 ms·

The company I work for, Onfido, has recently released something similar to this: https://onfido.com/solutions/studio/ https://onfido.com/solutions/studio/ Host

by orf 4y ago

The company I work for, Onfido, has recently released something similar to this: https://onfido.com/solutions/studio/ https://onfido.com/solutions/studio/ Hosting this yourself is one thing, but there are big advantages to outsourcing it.

smt88 4y ago
> there are big advantages to outsourcing it I'm not sure I disagree, but you should elaborate. I don't see pricing anywhere on that page, so it's impossible to decide if the advantages outweigh the costs anyway.
- mpeg 4y ago
  If your chief risk officer is any good, they will start raising red flags all over if you suggest in-housing KYC fully. You suddenly have to think about stuff like: - where are you storing the passport data? Who has access to it? How is it processed? - what’s the process in case of a data breach, what regulators must be notified - what data sources are you querying? Sanctions lists, etc. how often are they updated? - do you need to support one country only, or multiple? Each country will have their own quirks in the process That’s just off the top of my head.
  - alonp99 4y ago
    Again, good points! this is exactly what we want to take off of the dev/CTO shoulders when going into the CRO’s office, we might need to do a better job communicating what the project is about. - You can choose where to store the data, you can either keep it in the vendor's hand if it's more comfortable for the CRO or use your own AWS and GCS for specific geographies (e.g. GDPR). for those who have access to the data we have RBAC built-in into the back office, we’ve seen that most companies are actually building their own back office since identity verification providers usually won't give something operational for manual approvals - so getting one that is built with best practices in mind and maintained by a community is a big benefit in a security aspect. - Each company that deals with such processes have its own regulatory framework they are under and they are obliged to assign personnel to build and maintain a policy and make sure the company acts according to it it. - You can orchestrate that entirely, using whatever data source you need, by using an existing integration or adding a new one. - This is a big plus for having a community that is spread across multiple geographies and can help build local solutions that will make the system global (stuff like which data you need to collect, how much time data should be stored, in what area it should be stored, and which vendors works best with specific data).
    - mpeg 4y ago
      It makes sense, I didn’t really mean my comment as a dismissal of your product btw; I understand that you’re trying to build a set of tools that cover the whole range of what a company might need to do KYC — you’re not really competing with onfido in that sense, as the next onfido could use your product as a building block (or acquire you).
victor9000 4y ago
Depending on a 3rd party for your customer data seems like a really big risk, no?
- mpeg 4y ago
  Hey, as someone who’s had to implement this in the past: no. If anything, outsourcing your KYC makes a lot of sense for most companies. You reduce risk as vendors like onfido have spent literally hundreds of millions building their platform (and would already use a number of public and private data sources to prevent fraud) If you’re building a bank, it might make sense to in-house it, otherwise it’s just exposing yourself to increased fraud rates and potential data breaches.
  - lmeyerov 4y ago
    Very much this. Same reason it's nice to use Stripe so you're not the one holding your customer's credit cards. Holding anyone's passport photo sounds horrible.
    - alonp99 4y ago
      Solid points. from what we’ve seen it defers between different companies. Each company has its own preferences, some find it less optimal to send IDs to a 3rd party, and some don’t want to host it themself, and this is why we built it to be entirely modular. It means you can either use a vendor in the backend (for fraud, file storage, AML, or anything else) or do stuff on your own, we want to make sure the underlying infrastructure won't break when you mix and match those. we do it by standardizing the data and how all modules talk with each other. From what we’ve seen it really depends on what service the company is giving, who are the customers, and sometimes the size of the company.
alonp99 4y ago
We used Onfido for quite a while, we think you guys are great. I think the solutions you're comparing here are different in more ways than where it is hosted. For example, This project is about not being tied to a specific vendor, all modules are completely vendor agnostic. let’s say that you start with one vendor and after a while, you either are not satisfied with the results and want to switch a vendor without changing your internal operations workflow or maybe you have a new geography to cover and you need another vendor for it that will fit the rest of the tools you are using, with this project you can use the same tools to send your document to whichever vendor you want. We built it for customization from the ground up, and since it's open source - it's at the code level. we expect to see UI packs, flow and vendor compositing, liveliness challenges, etc all developed in the community and for the community to use.

by orf 4y ago

smt88 4y ago

> there are big advantages to outsourcing it I'm not sure I disagree, but you should elaborate. I don't see pricing anywhere on that page, so it's impossible to decide if the advantages outweigh the costs anyway.

mpeg 4y ago
If your chief risk officer is any good, they will start raising red flags all over if you suggest in-housing KYC fully. You suddenly have to think about stuff like: - where are you storing the passport data? Who has access to it? How is it processed? - what’s the process in case of a data breach, what regulators must be notified - what data sources are you querying? Sanctions lists, etc. how often are they updated? - do you need to support one country only, or multiple? Each country will have their own quirks in the process That’s just off the top of my head.
- alonp99 4y ago
  Again, good points! this is exactly what we want to take off of the dev/CTO shoulders when going into the CRO’s office, we might need to do a better job communicating what the project is about. - You can choose where to store the data, you can either keep it in the vendor's hand if it's more comfortable for the CRO or use your own AWS and GCS for specific geographies (e.g. GDPR). for those who have access to the data we have RBAC built-in into the back office, we’ve seen that most companies are actually building their own back office since identity verification providers usually won't give something operational for manual approvals - so getting one that is built with best practices in mind and maintained by a community is a big benefit in a security aspect. - Each company that deals with such processes have its own regulatory framework they are under and they are obliged to assign personnel to build and maintain a policy and make sure the company acts according to it it. - You can orchestrate that entirely, using whatever data source you need, by using an existing integration or adding a new one. - This is a big plus for having a community that is spread across multiple geographies and can help build local solutions that will make the system global (stuff like which data you need to collect, how much time data should be stored, in what area it should be stored, and which vendors works best with specific data).
  - mpeg 4y ago
    It makes sense, I didn’t really mean my comment as a dismissal of your product btw; I understand that you’re trying to build a set of tools that cover the whole range of what a company might need to do KYC — you’re not really competing with onfido in that sense, as the next onfido could use your product as a building block (or acquire you).

victor9000 4y ago

Depending on a 3rd party for your customer data seems like a really big risk, no?

mpeg 4y ago
Hey, as someone who’s had to implement this in the past: no. If anything, outsourcing your KYC makes a lot of sense for most companies. You reduce risk as vendors like onfido have spent literally hundreds of millions building their platform (and would already use a number of public and private data sources to prevent fraud) If you’re building a bank, it might make sense to in-house it, otherwise it’s just exposing yourself to increased fraud rates and potential data breaches.
- lmeyerov 4y ago
  Very much this. Same reason it's nice to use Stripe so you're not the one holding your customer's credit cards. Holding anyone's passport photo sounds horrible.
  - alonp99 4y ago
    Solid points. from what we’ve seen it defers between different companies. Each company has its own preferences, some find it less optimal to send IDs to a 3rd party, and some don’t want to host it themself, and this is why we built it to be entirely modular. It means you can either use a vendor in the backend (for fraud, file storage, AML, or anything else) or do stuff on your own, we want to make sure the underlying infrastructure won't break when you mix and match those. we do it by standardizing the data and how all modules talk with each other. From what we’ve seen it really depends on what service the company is giving, who are the customers, and sometimes the size of the company.

alonp99 4y ago

We used Onfido for quite a while, we think you guys are great. I think the solutions you're comparing here are different in more ways than where it is hosted. For example, This project is about not being tied to a specific vendor, all modules are completely vendor agnostic. let’s say that you start with one vendor and after a while, you either are not satisfied with the results and want to switch a vendor without changing your internal operations workflow or maybe you have a new geography to cover and you need another vendor for it that will fit the rest of the tools you are using, with this project you can use the same tools to send your document to whichever vendor you want. We built it for customization from the ground up, and since it's open source - it's at the code level. we expect to see UI packs, flow and vendor compositing, liveliness challenges, etc all developed in the community and for the community to use.