The vocabulary, in plain language.

All terms

Liveness (liveness detection)

A check that confirms a real, live person is present during a verification, not a photo, a screen replay or a mask. ShieldID uses an active, guided challenge (blink, turn, return to centre) tracked on 478 facial landmarks over at least ten frames.Liveness Detection product page

Active vs. passive liveness

Passive liveness analyzes a single image or short clip without asking the person to do anything. Active liveness asks them to complete a guided challenge in real time, which is harder for a static photo or a pre-recorded video to fake. ShieldID's liveness check is active.How active liveness works

Presentation attack

An attempt to fool a biometric check by presenting something other than a live, cooperative person — a printed photo, a video replay, a mask or a deepfake. Anti-spoof, liveness and mask detection each defend against a different kind of presentation attack.How active liveness works

Deepfake

A synthetically generated or manipulated face, video or image, created to impersonate a real person. ShieldID runs deepfake detection as its own, separately reported check on every selfie.Liveness Detection product page

MRZ (machine-readable zone)

The two or three lines of characters at the bottom of a passport's photo page, encoding the holder's details in a standardized, checksummed format that can be read by machine and cross-checked against the printed page.Data Extraction (OCR) product page

PDF417

The stacked barcode format printed on the back of most North American driver's licences and ID cards, capable of holding structured text data like name, date of birth and document number in a small, scannable space.Reading a PDF417 barcode

AAMVA

The American Association of Motor Vehicle Administrators, whose standard defines how data is laid out inside a PDF417 barcode on a North American driver's licence or ID card, so different issuers' barcodes can be read consistently.Reading a PDF417 barcode

IIN (issuer identification number)

A short numeric code embedded in an AAMVA-compliant barcode that identifies which licensing authority (province, state or territory) issued the card, letting a document reader apply that issuer's exact field layout.Reading a PDF417 barcode

OCR (optical character recognition)

Reading printed text from an image — in ShieldID's case, the front of a government ID — and turning it into structured data that can be compared against the barcode and MRZ.Data Extraction (OCR) product page

Face match

Comparing a live selfie against the photo printed on a government ID to confirm they're the same person, using a face-recognition model built for phone photos and reported against a fixed decision line.Face Match product page

False match rate

How often a face-matching system incorrectly reports two different people as a match, measured on a stated sample size. We publish this only once it's genuinely measured on real, consented traffic — a bare accuracy percentage without that context is not something we'll print.Face Match product page

Decision line

The fixed threshold a face-match score is reported against to produce a pass or fail result, instead of showing a raw percentage that's easy to misread as a probability.Face Match product page

Per-field verdict

A pass, fail or skip reported separately for each field or check — name, date of birth, document match, liveness, face match — instead of one bundled score. Unfamiliar documents are read field by field rather than refused outright.ID Document Verification product page

PIPEDA

The federal Personal Information Protection and Electronic Documents Act, which governs how private-sector organizations in Canada collect, use and disclose personal information. ShieldID is designed to align with PIPEDA; no vendor can claim to be “certified” under it, since no such certification exists.What PIPEDA means for ID verification

Law 25

Quebec's provincial privacy law, which sets its own, generally stricter requirements on top of PIPEDA, including specific attention to biometric data such as face matching and liveness.What PIPEDA means for ID verification

FINTRAC

Canada's Financial Transactions and Reports Analysis Centre, the federal agency behind anti-money-laundering rules that require certain businesses to identify their clients. Whether a specific verification method satisfies FINTRAC's requirements is a compliance question, not something a vendor can certify.Identity verification for law firms

KYC (Know Your Customer)

The general practice of verifying who a customer or applicant is before doing business with them. ShieldID's document, face match and liveness checks are the core building blocks of a KYC process.Identity verification for fintech and lending

KYB (Know Your Business)

The practice of verifying a business entity and its beneficial owners, as distinct from verifying an individual. ShieldID verifies individuals today; business-entity verification is a related but separate discipline.

CIP (Client Identification Procedures)

The documented process a regulated business, such as a law firm, uses to identify its clients, often required to satisfy obligations referenced by FINTRAC or a Law Society. ShieldID's checks are one input to a CIP; the process itself is defined by your organization.Identity verification for law firms

Data residency

Where data is physically processed and stored. ShieldID runs on self-managed infrastructure we control in Canada, not a public cloud provider.Data residency

Retention

How long data is kept before it's deleted. ShieldID's default retention for ID images is seven days; the verification record itself is kept separately. Per-account retention settings are coming soon.Retention & deletion

Purge

The automatic deletion of ID images once their retention timer expires. ShieldID runs this sweep on an hourly interval, seven days by default.Retention & deletion

Append-only

A record that can only have entries added to it, never edited or deleted — enforced by the database itself, not just by policy. The Activity Ledger — Trust Ledger's shared record that ShieldID integrations write to — is append-only. Not the same as a hash chain or a blockchain, and we don't describe it as either.Activity Ledger product page

Audit trail

A record of who did what, when, that can be reviewed after the fact. The Activity Ledger is Trust Ledger's searchable, append-only audit trail, covering sign-ins, API-key activity and — for Crown Stack integrations — verification outcomes, filterable by actor, action, target and date. Equivalent entries for a standalone ShieldID API account are coming soon.Activity Ledger product page

Webhook

An HTTP callback ShieldID sends to your server when a verification result is ready, so you don't have to keep polling for it. ShieldID's webhooks are signed and retried up to three times.API reference

HMAC

A cryptographic signature used to prove a webhook actually came from ShieldID and wasn't forged or altered in transit. ShieldID signs webhooks with HMAC-SHA256.API reference

Sandbox

A test environment that exercises the same API and applicant flow as production, using sandbox API keys. Sandbox sessions are never billed, on qualifying plans.Sandbox

API key

A credential your server uses to authenticate requests to the ShieldID API. Keys are per-environment (sandbox or production) and stored as SHA-256 hashes, with only a prefix kept in the clear.API reference

Hosted flow

A verification page ShieldID hosts for you, with your branding and a return URL, so you can send an applicant a link instead of building your own capture UI.SDKs

White-label

Branding the hosted verification flow with your own company name, colours and logo instead of ShieldID's, available on qualifying plans.SDKs