Developer preview
IDoro is age assurance built the other way round. A person verifies once with a government document and a liveness check — then that raw evidence is destroyed. Every service they visit afterwards receives one boolean and a pseudonym that belongs to that service alone.
Regulatory-grade age assurance for platforms under the EU Digital Services Act and the UK Online Safety Act.
Zero
Documents or biometrics retained after a check completes
Once
One verification, reusable across every participating service
Boolean
The entirety of what a relying party learns about a person
Pairwise
A different pseudonym per service, so nobody can correlate users
The problem
The EU Digital Services Act, the UK Online Safety Act and national implementations oblige platforms to enforce age assurance. The obligation is no longer optional and no longer limited to adult content — social, gaming, streaming, gambling and regulated e-commerce are all in scope.
Most providers satisfy the age requirement by collecting and retaining identity documents and biometrics. That converts a compliance obligation into a permanent breach surface and a data-minimisation problem under GDPR — trading one regulator's approval for another's exposure.
IDoro removes the trade-off. The evidence needed to establish age exists only for the seconds it takes to evaluate it. What persists is an assertion — not a person.
How it works
The user presents a government-issued document together with a biometric liveness check, through a certified verification provider.
As soon as the age bands are established, the document imagery and biometric capture are discarded. They are never written to durable storage.
The user receives a non-identifying, cryptographically signed age assertion. It carries an age band — never a birth date, a name or a document number.
Issuance, revocation and every age check are written to a permissioned enterprise ledger, giving auditors and regulators a tamper-evident record that no single party can quietly rewrite.
Relying parties integrate over a REST API. A check is one request and one response:
meets_required_age: true, plus the pseudonym for that relying party.
Privacy architecture
Each relying party receives a pseudonym derived specifically for that user-and-service pair. Two services holding records for the same person hold two unrelated identifiers.
There is no wallet ID, account number or national identifier travelling between services, so there is nothing for a data broker to join on — even after a breach at a relying party.
Duplicate enrolment is prevented by comparing non-invertible feature hashes. The original face image is never stored and cannot be reconstructed from what we hold.
Revoking an assertion appends a revocation record rather than editing history. The audit trail stays complete and internally consistent.
IDoro does not require a state identity wallet to function, so availability is not tied to any one government's rollout, policy change or outage.
There is no central store of documents or biometrics to exfiltrate. The worst case is bounded to isolated assertion revocations, not a population-scale identity leak.
Pairwise identifier derivation follows the pattern described in OpenID Connect Core §8.1. The permissioned ledger is a private enterprise audit ledger — there is no cryptocurrency, no public chain and no tradeable asset anywhere in the system.
Who it's for
Social, gaming, streaming and user-generated-content services obliged to enforce age assurance under the DSA and the Online Safety Act.
Online gambling, alcohol, tobacco and pharmacy operators with cross-border age obligations across the EU and UK.
KYC and AML vendors who want to offer a zero-retention age layer on top of the document verification they already run.
Digital ministries and regulators seeking enforceable age assurance that does not require building a population identity database.
Organisations that need assured age signals without taking on biometric retention liability in-house.
Teams who want to integrate an age check in an afternoon, test against a sandbox ledger, and ship without a procurement cycle.
Pricing
Free
Most popular
€0.12 / verification
Custom
Add-ons: compliance audit reports · data-destruction certificates · integration services. Pricing shown is our planned commercial pricing at general availability.
Standards & compliance
Where we are
Verification flow, pairwise pseudonym engine, permissioned audit ledger and REST API, running end to end.
Sandbox environment and self-service developer tier. We are here.
First platform integrations in regulated sectors, with compliance feedback feeding the certification audit.
ISO/IEC 29115 LoA 2/3 and formal GDPR assessment, as required for EU and UK platform procurement.
Production platform with a 99.9% SLA and white-label enterprise tier. Targeting Q1 2027.
Get in touch
Whether you're a platform facing an age assurance deadline, an identity provider looking for a zero-retention layer, or a regulator assessing the approach — we'd like to hear from you.