Auto Secure LoginFace verification that fails closed — and never overclaims.
ASL Verifier is privacy-first one-to-one facial comparison. It does exactly two things: compare an ID portrait to a live selfie, and compare two stills (non-authenticating). A local OpenCV engine does the work — images never leave the box, every comparison is metadata-only, and the decision engine is architecturally fail-closed. It is explicitly not surveillance, gallery matching, demographic inference, or one-to-many search, and it says so.
The problem
Face tech earns distrust by doing too much.
Most facial software slides from "verify this one person" into gallery search, demographic guessing, and quiet surveillance — and uploads your face to someone else's cloud to do it. That's exactly the behavior that makes the technology radioactive.
Verifier draws a hard line: one-to-one comparison, on the box, metadata-only, with a decision engine that turns any missing signal, engine failure, or policy mismatch into REVIEW or FAIL — never a fallback to PASS.
What it refuses to do
- One-to-many / gallery search
- Demographic or attribute inference
- Surveillance or watch-listing
- Send images off the box
- Issue a PASS it can't prove
Capabilities
A narrow tool, built to stay narrow.
Two isolated features
ID-to-live and photo-to-photo have different result contracts — the non-authenticating path can't be mistaken for an approval.
Fail-closed engine
Any missing signal, FAIL, or policy mismatch resolves to REVIEW or FAIL — there is no code path that falls back to PASS.
Signed PASS receipts
Short-lived Ed25519 (EdDSA) receipts with replay-guarded jti, and strict allow-listing of engine results.
Local OpenCV
YuNet detection + SFace comparison run locally, with SHA-256 model-integrity checks on pinned ONNX models.
Ephemeral media
Images are ≤12 MiB, streamed, buffers zeroed, with no upload directory — nothing lingers on disk.
Metadata-only audit
An HMAC audit records the decision and context — never the face.
Versioned consent
Consent is bound to a notice digest and versioned, so you can prove exactly what a subject agreed to.
Dual-port trust split
The portal (:5080) and the engine (:5081) are separated, with a strict CSP and bilingual EN/ES UI.
Native Android capture
CameraX capture that never accepts a gallery image as "live," with buffers wiped after use.
Verify one person. Nothing more.
On-box, metadata-only, 1:1 face verification that fails closed and never issues a PASS it can't prove.