A level is not a badge somebody grants you. It is a set of claims that were all true at the same moment.
Every Xuda account carries a verification level from 0 to 4, and it is computed rather than awarded. A deterministic scorer turns typed signals into a score, then walks the levels from 1 upward, granting one only when every claim that level requires is held AND the score clears that level's own floor. The walk stops at the first gap, because levels are cumulative: an account that has already corroborated a card sits at level 1 until it has photographed an identity document, and no amount of good behaviour anywhere else moves it. Level 1 Contact asks for a confirmed email, a phone that answered an SMS code, and a line that is not virtual. Level 2 Identity asks a person for a photo ID, a live capture, a face match between the two and a profile picture that matches the same face; it asks a company for that same identity chain plus its own papers, a public register that agrees the company exists, and the person on the verified document being an active officer of it. The models that read a document or a web page never issue a verdict. They turn a photograph into typed fields, and a policy file decides what those fields are worth, which is why the same evidence produces the same answer twice and why moving a threshold is a config edit rather than a deployment. Every stored decision records the policy version it was computed under, currently 1.8.0.
Two tests, in this order, and the walk stops at the first gap.
Most verification systems answer pass or fail. This one answers with a level, a set of claims and a list of reasons, and it recomputes all three from scratch every time you look at it. That is what makes the answer explainable: nothing is remembered as a verdict, only as evidence, and the verdict is rebuilt from the evidence on the spot.
- Claims are additive and sticky. A check that succeeded once is not re-run every time your score is recomputed, so a passing document read does not have to keep passing. The narrow exception is a definite negative answer: a company that has since been dissolved, a card that now links to a suspended account. An unreachable service never revokes anything, because an outage that stripped earned claims would be worse than the outage.
- The score is not a second opinion on the same evidence. It is a separate quantity built from signals the claims do not cover: how old the account is, whether it has ever been used, what kind of phone line answered, whether the connection comes from a datacenter, whether a payment on it was ever reported as fraudulent. A claim says something was proved. The score says whether anything about the account argues against it.
- Level 1's floor is 0, and that is deliberate rather than lazy. Every positive number tried there has been wrong twice: a floor of 25 blocked a user who held all three level 1 claims on a landline, and 10 then blocked a brand new business holding all three on a real mobile, because a fresh account that has not used the platform yet scores 7. An account that has proved an email and a real phone HAS become reachable, so only an adverse signal keeps it out.
- Because the walk stops at the first gap, missing_by_level is published for every level rather than only the next one. Somebody stuck at level 1 can still read exactly what level 3 will ask for. What is never published is the weight of any individual signal: you see what to do next, not how to game it.
- CollectAccount history, phone, domain, Stripe, network and correlation sources are read into typed signals. No free text ever reaches the scorer.
- ScoreEach signal maps to points through the policy file: a band, a boolean or a lookup. Nothing is hardcoded in the module.
- ResolveWalk levels 1 upward. A level is granted only when its required claims are all held and the score clears its floor. Stop at the first gap.
- ProjectLevel, claims and score are written onto the account document, so a caller holding an account does not need a second round trip to know its level.
levels, and a gap at one caps you there
possible orders for a live capture, drawn after you ask for it
score floor at level 2, on top of every claim
what verifying your own account costs, on any plan
A person proves a face. A company proves a face, and then ties it to a register.
Level 1 asks a company for exactly what it asks a person for, which was not always true and is the single biggest change in policy 1.8.0. Being reachable is being reachable, so a business is reached on an email and a phone like anybody else, and there is one OTP step, one gate and one set of words whichever kind of account is signing up. That has a real consequence and it is intended: a business whose only number is a VOIP line cannot hold level 1, which is the same wall a personal account meets. Level 2 is where the two genuinely diverge, and they diverge in kind rather than in count.
Four levels, what each one asks for, and what it actually changes today.
Read the columns down rather than across. The claims column is the honest one: a level is its claims, and the floor beneath them only keeps out an account carrying something heavy and negative, since a fraud report is minus 30 and a suspension is minus 40. The last row is the one most pages leave out.
1 · Contact | 2 · Identity | 3 · Financial | 4 · Networks | |
|---|---|---|---|---|
| What a person must hold | A confirmed email, a phone that answered an SMS code, and a line that is not virtual. | A parsed photo ID, a live capture, a face match between them, and a profile picture that matches the same face. | A corroborated payment record and a clean screening result, both earned on the spot rather than waited for. | A web and social footprint that was checked, and a cross account correlation graph that came back clear. |
| What a company must hold | Identical to a person. Being reachable is being reachable, and there is one OTP step for both. | The same identity chain, plus company papers, a register that agrees, and you as an active officer on it. | The same two, plus a verified tax ID. | Identical to a person, read against the company footprint as well as the individual one. |
| Score floor | 0. Only an adverse signal keeps you out, never a quiet account. | 45. | 45. Dropped from 60 so an account that passes every check is not told to come back in a week. | 75. |
| What it is a prerequisite for | Nothing on its own. It is the floor the rest of the ladder stands on. | A profile picture, any contact action, buying a phone number, adding a mailbox, using a portable IP outside Xuda, registering a domain, ordering from the store, and running code on Xucode. | Setting up a campaign. | A seller account, an ambassador seat and a mentor seat. |
| Does it stop you today | No. | Not on production. The one real consequence is the generated avatar, which is withheld below level 2 and is deliberately not held behind the rollout. | On production, no. The shared policy file names 3 as the intended floor and the dev box runs it; production states the floor as null, which the code reads as watch and never deny. | Same as level 3. |
| Where it is refused outright | Nowhere. Level 1 involves no biometrics and is available everywhere. | Canada, China and Russia. That refusal is deliberately exempt from the rollout. | Same three countries, since level 2 is a prerequisite. | Same three countries. |
The document is the anchor, and the order is enforced.
The document goes first because it is the only one of the three images issued by somebody else. Matching a profile picture against a selfie proves the two agree, not that either one is you. The live capture refuses to start at all until the document has been accepted, which is a cheap check off the stored subject rather than a full recompute: finding out afterwards that the document never passed is the worst possible moment to find out.
The status read, for an account stuck at level 1.
This is the shape every verification surface renders from, recomputed on each call rather than read from a cache. Note what is in it and what is not. It carries the next level, the exact claims still missing at that level and at every other one, plain language reasons for the score, whether a person is looking at it and which half they are looking at. It carries no signal weights at all, because a user should see what to do next and not what to optimise.
The score is what the account argues about itself.
Claims are things you proved. The score is everything else the platform already knows, mapped to points through the same policy file, and it is the reason two accounts holding identical claims can sit at different levels. Nothing here is a verdict on you as a person: it is a set of small, boring facts about an account, several of them flagged so they can only ever help.
- The phone line type is the single heaviest positive at level 1, and it is why the level exists in the shape it does. A real mobile is worth 14 points, a landline 9, a fixed VOIP line 2, and a non fixed VOIP number is minus 12 with a stated reason. A number that can be rented for an afternoon is not a contact channel.
- Time and use pay more than anything you can buy. An account older than 180 days carries 20 points and one created today carries 0; an account that has actually built something carries up to 14 more. A paid membership is worth 10, which is less than simply having used the platform for six months.
- The negatives are the ones with real weight. A suspension is minus 40, a fraud report minus 30, a disposable mail domain minus 15, a prepaid card minus 12, a connection from a hosting provider minus 8, one through a VPN minus 6, and a connection country that does not match the country on file minus 5.
- Some checks are free and some are not, and the split is published rather than hidden. Account history, device and network, payment corroboration, domain control and the correlation graph cost nothing. A phone line lookup is a cent, an OTP five, a document read four, a face match one, a liveness check two, a business register lookup twenty five, and a human review three dollars.
Nine channels, no verdict among them, one level at the bottom.
No single check can grant a level, and none of them decides anything. Every one produces typed signals in the same shape, and a deterministic scorer running over a versioned policy file is the only thing that ever issues a number. That is also the whole of the prompt injection posture: the models never see a decision to make, the scorer never sees free text, and instruction like text found inside a submitted document is itself treated as a fraud signal and counts against the submission.
Seven things this is not, including the two most likely to be assumed.
- It is not government grade document proofing and must never be described as one. Nothing here authenticates a document against issuer security features. What it does instead is check that independent channels agree, which is a different claim and a much harder one to fake than any single artifact, but it is not the same claim.
- Level 2 is not stopping anybody on production today. Eight product gates name level 2, and the enforcement floor on production is stated as null, which the code reads as watch and never deny. The dev box runs the floor the shared policy names, which is 3. The one consequence that is real at level 2 everywhere is the generated avatar: it is withheld below level 2 and deliberately not held behind the rollout, because withholding it IS the enforcement.
- Liveness stops a printed photo, a screenshot, a saved selfie and the same frame submitted twice. A video of the subject re-cut into the requested order, and a live deepfake driven by the same prompts, both still pass. That is on this page rather than left to be discovered.
- Verification above level 1 is refused in Canada, China and Russia, and that refusal is exempt from the rollout on purpose. Calibrating a score is not permission to process biometric data somewhere Xuda is not cleared to operate. Canada is blocked whole because Quebec requires a filing 60 days before a biometric system goes into service and the network layer gives us a country, not a province.
- Selling verification to your own users is a separate product with its own limits. The sandbox completes end to end today, unlimited and never counted, and a live session link is created and valid before live capture for external users opens. Both the dashboard and the API say so up front rather than letting the person reaching the link discover it at the end.
- A business register that answers is not the same as one that exists everywhere. The United Kingdom is a direct integration and New York answers for itself; everything else depends on an aggregator, and where no register publishes officers, org_authority is simply not granted rather than granted on evidence nobody has.
- The level on your account is a projection, not the record. Level, claims and score are written onto the account document so a caller already holding one does not need a second round trip. The evidence and the audit trail live in the verification database, and the projection is rebuilt from them, never the other way round.
The questions the badge does not answer
Seven answers read out of verify_policy.json 1.8.0 and cpi/verify_module rather than off a marketing page.
Three surfaces, three audiences, and they are deliberately not the same screen.
Verification was split into separate surfaces after somebody following a level 2 link landed on the screen for selling verification to other people. Your own level lives under your profile because that is the identity it gates. The service you sell is a different product with its own subscription line.
The nine channels, what is kept and what is dropped, the tier ladder for running verification on your own users, and how it compares to a hosted KYC vendor.
Read the detailA seller account names level 4, alongside the Stripe Connect gate that has always been there.
Explore the MarketplaceYour own verification is not on the price list because it is not priced. The Trust Center tiers, for verifying other people, are a separate line on the one consolidated subscription.
See pricingOpen the ladder and read your own gap.
The verification page under your profile shows the level you hold, the exact claims still missing at the next one, and the plain language reasons behind your score. It takes one status call to find out, it costs nothing on any plan, and nothing on your account is held back while the rollout finishes. If you want to run the same checks on your own users instead, that is the Trust Center, and the sandbox completes end to end today without a card.