CaftishSign in

Caftish docs

How the workspace operates

Caftish helps a team run customer due diligence workflows and keep a record of the decisions. Simulated checks are labeled “Simulated provider response” and are not identity verification, sanctions screening, or a regulatory determination. Caftish does not claim SOC 2, ISO 27001, or any compliance certification.

Walk a verification

  1. Sign in. Demo accounts are listed on the sign-in page. Privileged roles complete TOTP.
  2. Stay in the Test environment unless you mean to use live data.
  3. Open Verifications and create a session. Document numbers beginning with FAIL or EXPIRED fail the document check. A legal name containing “mismatch” fails identity. Liveness token “fail” fails liveness.
  4. Auto-approval happens only when identity, document, liveness, sanctions, and PEP checks passed, risk is within the published policy, and no screening disposition blocks the decision.
  5. Otherwise the session waits for manual review. Approve and reject still re-check those conditions.

Screening and cases

Dispositions require a rationale. A confirmed match also needs an evidence note. Name similarity is capped below 1 and is never treated as proof of identity. Confidential suspicious-activity cases are visible only to owners and compliance officers, and the case page warns against tipping off the customer.

Businesses

UBO thresholds are configured per organization and can differ by jurisdiction. Registration numbers prefixed NF, CF, or PT simulate not-found, conflicting, and partial registry results. Incomplete ownership, conflicting records, unresolved screening, or high risk opens a case.

Developers

Create a test key under Developer. The secret is shown once. Send Authorization: Bearer and an Idempotency-Key to POST /api/v1/verification-sessions. Webhooks use Caftish-Signature: t=<unix>,v1=<hex hmac sha256 of timestamp.rawBody> and reject timestamps outside five minutes. Revoked keys fail closed.

Where data goes

Customer details, check summaries, and evidence references stay in your Postgres database and private object storage. With no S3 configuration, evidence files stay on the app disk. The simulated providers do not transmit data to an external bureau. If you later configure a webhook, the event payload is sent to that URL. Audit metadata is redacted and chained with SHA-256.

Sign in