Multi-Factor Authentication (MFA) Software Resources

Daon's facial biometric capabilities have been evaluated across multiple independent testing programs. NIST FRVT testing validated 1:1 verification and 1:N identification accuracy. NIST FATE testing in August 2025 ranked Daon's face quality assessment algorithm first of 56 products in one of the two scored scenarios. iBeta PAD testing at both Level 1 and Level 2 produced 100% success rates. The algorithms have also been evaluated specifically for 3D artifact detection and injection attack detection as separate testing criteria. All NIST programs use sequestered datasets with no vendor access in advance, making them the most credible independent benchmarks available.

Show More

Show Less

That depends on which product is deployed and how the platform is implemented. For passkey-based authentication through xAuth, the credential is stored on the user's device. For xFace server-side biometric authentication, templates are stored server-side in encrypted, irreversible format that cannot be reconstructed into an original image. They are also stored separately from the users personal information as an extra security layer to prevent connecting a template with a user. Where those server-side templates are physically hosted depends on platform and deployment. TrustX stores templates on an AWS cloud server usually regionally located to the client. IdentityX can store the templates on a Daon-managed cloud server, client-managed cloud infrastructure, or client-managed on-premises server. In all server-side deployments, the organization controls the templates, matching thresholds, and security policies, with optional BYOK for full cryptographic ownership of encryption keys.

Show More

Show Less

Passkeys authenticate using the device's local biometric sensor to unlock a cryptographic key stored on that device. The match happens on the device, which means the relying party receives confirmation that someone who can unlock the device was present, not that a specific verified individual was present. xFace matches a selfie against an encrypted biometric template stored on a secure server, which can be captured during IDV enrollment or at a later point in the customer lifecycle. By matching the live user to a central template, it proves that the person is requesting access, not just their known device. That distinction matters for high-risk transactions, account recovery, and regulated use cases where identity assurance is required, not just device access confirmation. It also makes authentication channel-agnostic, so a user can access services from any device in any location.

Show More

Show Less