Skip to content

IDV Platform 3.10 Release Notes—October 29, 2026

Major New Features

Role-Based Access Control (RBAC)

The new role management system introduces role-based access control (RBAC) in IDV Platform.

RBAC provides Platform administrators and other authorized users with the following capabilities for managing access to Platform features and resources:

  • Configurable roles and permissions. Use built-in roles or create and duplicate roles to meet the organization's needs. Define which resources users can access, including sessions, workflows, and profiles, and which operations they can perform, such as viewing, creating, updating, and deleting.
  • Group-based access management. Organize users into groups by team, department, or responsibility. Each group can have multiple roles, and each user can belong to multiple groups. Roles are assigned to groups, and users receive permissions through their group memberships.
  • Entity-level access control. Restrict access to specific resources using Entity IDs where supported. Access can also be granted through Creator Ownership for resources created by the user.
  • Built-in and custom groups. Use predefined groups or create custom groups for their organization. Custom groups can be created without users or roles and configured later.

Compliance. Risk Predictors

Risk Predictors introduce a new first-line protection mechanism that helps identify suspicious activity early in the identity verification process.

By detecting potential fraud before a verification session is completed, Risk Predictors help reduce unnecessary processing, paid third-party checks, and manual reviews.

How Risk Predictors work

Risk Predictors are predefined rules that can be enabled and configured according to an organization's verification scenarios and risk requirements.

They analyze signals such as IP addresses, device IDs, profile and session activity, and geographic patterns to identify potentially fraudulent behavior.

For example:

  • Multiple Profiles from the Same Device detects when an unusually high number of profiles are created from a single device within 24 hours. This may indicate automated account creation, profile farming, or coordinated fraud.
  • Geovelocity Anomaly detects activity from geographically distant locations within an unrealistically short period, which may indicate account compromise or location spoofing.

Additional predictors cover other suspicious patterns throughout the verification process.

Configurable thresholds and actions

Each Risk Predictor has configurable parameters that determine when a risk condition is detected.

For example, administrators can configure the maximum number of profiles created from one device within 24 hours or the maximum distance between locations within a specified period.

When a risk condition is detected, the Platform automatically applies the configured action. Depending on the predictor, this may include:

  • Blocking a device.
  • Rejecting a session.
  • Rejecting a profile.
  • Creating a case report for manual review.

Predictor logic is predefined. Administrators configure thresholds and response actions rather than creating new detection rules.

Workflow-specific configuration

Risk Predictors can be assigned to specific workflows to support different verification scenarios.

For example, a limit on profiles created from the same device may be appropriate for personal-device onboarding but unsuitable for shared registration terminals.

By default, predictors apply to all workflows. Administrators can restrict individual predictors to selected workflows to apply appropriate risk controls to different verification processes.

Administration and audit history

Risk Predictors are managed in the Settings section of the Platform.

Administrators can configure predictor parameters, response actions, and workflow assignments. Configuration changes are recorded in the audit history.

Access to Risk Predictor configuration is restricted to Platform Administrators.

Audit Log Monitor

A new Audit Log Monitor tool is available in the Back Office portal.

IDV Platform records interactions with the Platform, including API requests and actions performed by users in the Back Office portal, such as changing settings, editing profiles, and updating session statuses.

The Audit Log Monitor allows users to view recorded interactions and filter them by:

  • API method
  • User
  • Device
  • IP address from which the request originated
  • Date range

Each API call entry can be expanded to view detailed information, including request headers and query parameters.

Minor Features and Improvements

  • Step background images. Added support for setting background images in workflow steps.
  • Phone number validation. Added validation for phone number input fields. An error message is displayed when an invalid phone number is entered.
  • New session status: Blocked. Added a session status to indicate that a session has been forcibly closed due to detected fraudulent behavior.

  • Audit service configuration. Added two configuration parameters:

    • config.services.audit.workers—specifies the number of worker processes. Default: auto.
    • config.services.audit.threads—specifies the number of threads per worker. Default: 32.

    For more information, see Configuration: Services.

  • In IDV Platform configuration, api service renamed: The api service in IDV Platform has been renamed to backoffice. The previous service name, api, remains supported for backward compatibility in version 3.10. However, we recommend updating your configuration to use backoffice. For details, see Configuration: Services.

    Note

    During the upgrade, backoffice is unavailable for approximately 20 seconds. Schedule the upgrade during a maintenance window.