Skip to content

VeriSaaS Architecture

VeriSaaS Cloud architecture on AWS and Google Cloud

Architecture Overview

VeriSaaS Cloud exposes service APIs that allow customers to consume Veridas OCR, document validation and biometric services without having to worry about on-premises deployments. The services run on Amazon Web Services and Google Cloud, in three regions (AWS EU, AWS US and GCP EU), protected by the same security layers in both providers.

The customer is only responsible for the middleware, an application owned by the customer that manages the communication between the end user and VeriSaaS Cloud, and where most of the business logic resides.

The onboarding process works as follows:

  1. The end user starts the onboarding process by capturing images of their identity document and their biometric information, typically using Veridas SDKs (web, iOS, Android). The SDKs are optimized for capture. With XpressID, the web capture flow is served directly from VeriSaaS Cloud, through the same protection layers.
  2. The app or website sends the captured information to the customer's middleware.
  3. The middleware runs the customer's business logic and communicates with VeriSaaS Cloud services. This communication must use TLS 1.2 or TLS 1.3, and the middleware must authenticate with the apikey header in every request.
  4. Every request goes through the edge protection (Web Application Firewall and DDoS protection) and the API management layer (API key authentication, IP allowlist and rate limiting) before reaching the Veridas services.
  5. VeriSaaS Cloud processes all the images and videos uploaded by the middleware. When a service needs it, VeriSaaS Cloud performs government checks against official data sources (identity, document and registry checks). New countries and sources are added regularly.
  6. The middleware or a back office platform retrieves from VeriSaaS Cloud the document OCR data, document and biometric scores, image cuts and other results.
  7. Optionally, Veridas offers boi-das, an on-premises software solution for downloading, storing, archiving and reviewing all the validation processes.
  8. Finally, the customer's middleware, back office or boi-das deletes the validation. If that does not happen, the Veridas auto-cleaner process deletes it after a pre-established expiration time (for example, 30 minutes). Customers can also choose to store validations in VeriSaaS Cloud; see Data handling.