Engineering an eKYC Platform: Secure real-time document validation

Handling identity documents (such as passports, drivers licenses, or business registry files) is a high-risk engineering task. You must safeguard personal data from leaks while making the upload and verification process fast.

We designed and implemented an enterprise-grade eKYC/KYB identity verification platform that validates identity documents for European and Chinese-market clients. This is how we secured the platform architecture.

1. Secured Ingestion & Sandboxing

To prevent malicious file uploads (e.g. uploaded PDFs containing embedded shell scripts), all file uploads are quarantined in a sandboxed directory.

We implemented strict MIME-type checks and file signature verification (reading the actual magic bytes of the file rather than trusting the file extension). Non-compliant files are immediately rejected and logged.

function validateFileUpload($tmpName, $clientName) {
  $allowedMimeTypes = ['image/jpeg', 'image/png', 'application/pdf'];
  $finfo = finfo_open(FILEINFO_MIME_TYPE);
  $mime = finfo_file($finfo, $tmpName);
  finfo_close($finfo);

  if (!in_array($mime, $allowedMimeTypes)) {
    throw new Exception('Invalid file signature detected.');
  }

  // Sanitize file name to prevent directory traversal
  $safeName = preg_replace('/[^a-zA-Z0-9-.]/', '_', $clientName);
  return $safeName;
}

2. Encrypted Document Storage

Once files are validated, they are encrypted at rest using AES-256 before being written to our storage server. The decryption keys are managed separately, ensuring that even if storage media is compromised, customer data remains secure.

This encryption layer complies with GDPR and international data protection standards, protecting sensitive identity data from unauthorized access.

3. Asynchronous Verification and Webhooks

Upstream verification checks (like running OCR or facial comparison APIs) take anywhere from 10 seconds to 2 minutes. Blocking the user's HTTP connection is not an option as it causes timeouts.

We handle this by immediately returning a '202 Accepted' status code to the user interface. Background queue workers process the documents, send them to our verification partner, and listen to webhooks to update the account status once complete.

4. Verification Reliability Integration

• Process identity checks asynchronously via background workers to handle slow verification partner APIs.
• Track and audit every verification step, ensuring compliance officers can review processing logs.
• Implement automatic webhook fallbacks if the verification partner experiences network outages.

When building identity verification systems, treat security not as a feature, but as the core architectural constraint. Verify everything.

How do you securely store identity documents for eKYC verification?

Uploaded documents are quarantined in a private, non-public directory and validated by file signature - not file extension - before processing. Once verified, files are encrypted at rest with AES-256, with decryption keys held in a separate key-management service, so a storage breach alone never exposes readable identity documents.