iGaming identity verification

Identity + age + jurisdiction-issued. Stile resolves the credential's issuing state and returns it as a released attribute (e.g. jurisdiction_issued: 'US-NJ'). NJ iGaming statutory eligibility is based on in-state physical presence (geo-IP / IP-resolver), not residency — most NJ-licensed operators key the eligibility gate off geo-IP with credential-issuer as a supplementary signal. Operators in other states layer their own credential-issuer + geolocation policies as their license requires.

Stile produces a normalized identity assertion (legal name, document number hash, DOB hash, jurisdiction) accessible via the verification-result API once a session completes. The signed webhook fires on completion carrying the outcome + jurisdiction fields; the operator's backend reads the full assertion from the API and hands the fields its AML tooling needs (sanctions, PEP, OFAC, adverse media) to that vendor. Stile does not run sanctions screening directly — that's an AML-vendor concern downstream of the verification step.

Median ~3 seconds end-to-end for a document-capture flow on a modern smartphone: capture (1.5s) + server-side OCR/liveness/face-match (1.2s) + webhook delivery (~50ms). mDL flows are faster — ~1.5s end-to-end because the wallet handles the credential release without a document-capture round trip. Operator-side conversion testing typically shows registration drop-off concentrates at the document-capture step, not the verification step.

Photo-of-photo registration, replay attacks, deepfake injection, and 3D-mask attacks are all in scope for the passive liveness model. The model is retrained against new spoof samples on a rolling basis; threshold tuning is per-operator if the default false-rejection rate trips too many real users. Stile does not currently claim ISO/IEC 30107-3 PAD certification — see the liveness-detection page for the non-claim rationale.

No. Stile pre-declares which attributes the configured ruleset requires; the user sees those exact attributes on the wallet's system-managed consent screen (for mDL flows) or the SDK's capture screen (for document flows) and explicitly approves release. Attributes outside the request never reach the operator. This is the same selective-disclosure model ISO/IEC 18013-5 mandates for mDL — Stile applies it to physical credential flows for parity.