Projects

A Verifiable Credentials Platform Anchored by Biometrics

Type Machine learning algorithm, Web application
AREAS OF EXPERTISE Information Security
TEAM 1 Solution Architect, 6 Backend Engineers, 4 System Analysts, 2 QA Engineers

Our client, a blockchain company, is building a global “proof of humanity” network – a way for people to prove online that they’re real, unique individuals without giving up their personal data. We helped them build the backend platform that makes this possible: a system that turns real-world data (bank accounts, loyalty programs, KYC checks) into cryptographically signed Verifiable Credentials, anchored by palm biometrics and secured on the blockchain.

Users connect a real-world account – a hotel or airline loyalty program, a bank account via Mastercard Open Banking, a KYC provider, or a social account. The platform verifies the data, issues a signed credential (for example, “verified net worth above $10K” or “verified frequent traveler”), encrypts it, and anchors it on-chain. Any third party can then confirm the claim is true without ever seeing the personal data behind it.

What we did:

  • Cut length by ~40%, removing internal engineering detail that doesn’t help a buyer evaluate the work.
  • Folded the 6-step “How It Works” walkthrough into the intro, matching the reference cases’ structure.
  • Tightened Challenges and Solutions into a clean 1:1 mapping.
  • Led with client value before technology, mirroring the reference cases’ openings.
  • Kept only memorable, verifiable metrics (8M users, 16 services, 25+ providers, zero downtime).
  • Rewrote dense/passive sentences into plain, active language.
Challenges
  1. Rebuilding a live product without breaking it. The platform was running as a single monolith serving millions of users. It needed to become ~16 independently deployed microservices — each with its own data, infrastructure, and deployment pipeline — without any downtime for production traffic.
  2. Making identity data flow reliably across domains. Biometrics, banking, KYC, and social data all needed to move between services with strict boundaries and no risk of data loss or duplication.
  3. Keeping sensitive data out of reach — including from us. Verifiable Credentials carry personal claims that must be encrypted end-to-end and ultimately owned by the user, not locked inside a company database.
  4. Protecting biometric data by design. Palm biometrics are what make each identity unique, but the raw scan itself could never be stored or exposed anywhere.
Solutions
  1. Event-driven microservice architecture. Services communicate via gRPC (sync) and Kafka (async), with versioned events and idempotent processing to prevent data loss or duplication. A dedicated identity service acts as the single source of truth for every other service.
  2. AI-agentic development. Architects defined service boundaries, business rules, and test scenarios; AI agents implemented and verified the code within those guardrails — letting a small team ship 16 production services in months, with zero-downtime cutover.
  3. Envelope encryption and decentralized storage. Credentials are encrypted with per-service keys wrapped by AWS KMS, then stored as ciphertext outside any central database — laying the groundwork for full user self-custody.
  4. On-device biometric processing. Palm scans are converted into a compact biometric template on the user's device. Only this template, never the raw scan, is used for verification.
Results
  • 8 million live users and 10+ million credentials issued in production.
  • The monolith was fully decomposed into 16 independently deployed microservices on AWS, each with its own Terraform-managed infrastructure — with zero downtime during the transition.
  • 25+ external data providers integrated across travel, finance, KYC, and social platforms.

Business value

The platform answers a question that's becoming critical across Web3: is the account or wallet on the other side controlled by a real, unique human, or a bot? Biometric proof-of-personhood eliminates Sybil attacks in airdrops, governance votes, ticketing, and loyalty programs, while verified real-world credentials — financial standing, travel status, employment — let other applications personalize services without ever handling raw personal data.

For Humanity, the re-architecture turned a monolith that was hard to change into a platform where new credential types and verification flows can ship in days. And the AI-agentic development approach proved that a lean team can build and operate infrastructure at 8-million-user scale.

AR Office application
AR Office application
System for annotating X-ray images and generating pathologies
System for annotating X-ray images and generating pathologies