Same human,
every round.

Built onW3C WebAuthn / FIDO2RFC 8785 signed receipts

Regulatory statusGDPR Art. 22: a person decides every holdBIPA: hold Illinois enrollment until our retention policy is publishedEU AI Act: 1:1 verification, Annex III(4) scope under reviewWorks councils: co-determination before the pilot

• Proxy on the video. The scan proves who held the phone, not who is on camera. Re-scan mid-panel or when the video changes.
• One impostor, every round. Manav proves sameness, not identity. Pair it with your ID check at offer.
• Day-1 relay and laptop farms. A real candidate can relay the code in real time, and Manav gates the login, not the session after it. Pair it with device posture and EDR.
• Phone integrity. The face match runs in the phone browser and is reported in the signed receipt, not independently attested. Third-party camera-injection results are not yet published.
• Accuracy. False accepts (lookalikes, twins) and false flags are not yet measured or demographically tested. Both are measured on your candidates in the pilot, without collecting protected traits.
• Synced passkeys. A synced passkey proves the same Apple or Google account, not the same phone. The receipt records the synced-key flag, so your policy can require device-bound keys. Most iPhone and Android passkeys are synced, so a device-bound-only policy sends those candidates to the manual path. The default is set per gate in the pilot.
• One candidate, many employers. Whether key IDs are per employer or shared across our customers is not yet documented here; ask us before your DPIA.
• BIPA retention policy. BIPA requires a public retention and destruction policy before collection. Ours is not yet published; hold Illinois enrollment until it is. Your program decides who counts as an Illinois candidate, and BIPA also requires a written release.
• Receipt. req, round, time, key ID, method (passkey+face, manual, re-enrolled), synced-key flag, match yes/no. RFC 8785 JSON, passkey assertion plus our Ed25519 countersignature. It proves the receipt is unaltered, not that the phone was untampered.
• What our servers see. Key ID, receipt, IP, time, the employer credential and the consent record. Never a face image or pattern. Retention and region are set in your DPA.
• A person decides (GDPR Art. 22). A mismatch holds the step; a named person at your company decides, and the candidate is told how to retry or choose the ID check. If Manav is down, each gate fails open or closed as you set it; unchecked steps are marked "unchecked".
• Who can release a hold. Every release is logged in the receipt with the reviewer's name. You can require a second reviewer who is not the submitting recruiter or supplier, and report releases by reviewer.
• Lawful basis. Face matching is special-category data under GDPR Art. 9 and sensitive personal information under CPRA. Consent may not be freely given in hiring, so the ID-check path stays a real alternative. Works-council countries need co-determination before the pilot (e.g. BetrVG §87(1)6). Our DPIA pack sets out the Art. 9(2) basis we propose and what an employer needs to rely on it, with the ID-check path as the genuine alternative.
• Other US biometric laws. Texas CUBI and Washington RCW 19.375 notices and the CPRA notice at collection ship in the DPIA pack; check state coverage with your counsel before enrolling.
• Manual path. Any candidate can choose a recruiter-run ID check, marked "manual", with no effect on the application. Your program can require ID re-checks at offer and Day 1 for manual rounds and report manual rates by recruiter and supplier.
• Lost or new phone. Re-enroll only after an ID check. Someone other than the approving recruiter is notified, and the receipt says "re-enrolled".
• Face template on the phone. Kept in this site's browser storage on the candidate's phone. The candidate can delete it by clearing site data or withdrawing; we never hold a copy, so we cannot delete or recover it. Withdrawal stops future receipts; past receipts follow your DPA retention.
• Code integrity. The face pattern is kept and compared by our page code in the phone browser, so "never sent" holds only while that code is unchanged. Our client source and build hash are not yet published; a pattern sent to any server would show in a network trace.
• Accessibility. Candidates without a compatible phone, or for whom face capture does not work, use the manual path. It is not treated as a flag.
• Our signing key. Every receipt names the key ID that signed it, and the public key is published. Our key rotation and compromise-revocation process is not yet published.
• EU AI Act. We treat this as biometric verification, which Annex III(1) excludes. Whether hiring use falls under Annex III(4) is open; Manav does not rank or score candidates.
• Shadow pilot. It blocks nothing but still enrolls real candidates, so consent, BIPA and CPRA notices and your DPIA apply from the first enrollment. Privacy and DPIA pack
• Certifications and reporting. SOC 2 and ISO 27001 not started. Questions go through the disclosure page. Architecture, subprocessors, report a vulnerability.