SECURITY

Security without secrets

Cards and passwords are secrets — anyone who copies them becomes you. rostopay replaced secrets with presence: only your live face, on your device, can approve an online cash payment and move your money. There is nothing to steal, because nothing leaves you.

BIOVITAL LIVENESS 3-SHARD CRYPTOGRAPHY NON-CUSTODIAL ZERO STORED PHOTOS
STEP BY STEP

What happens in the second you glance

Four security layers run in under a second — all on your device, none on our servers. Watch the sequence light up.

ID verified · Alex M.
Instant recognition · 0.4s ✓
LIVENESS ✓ · 72 BPM
tx 0x8C31…B09 verifiable ✓
1
Capture — on your device only
The camera never uploads. Frames are processed locally and destroyed; no photo or video is created, stored or transmitted. Ever.
2
Liveness — proof you are alive and willing
Biovital signals — your live pulse read by light (rPPG), micro-movements, depth — with anti-deepfake detection. Photos, videos, masks and synthetic media are rejected. Coercion patterns block the payment.
3
Irreversible template — split into 3 shards
Your face becomes encrypted math that cannot be reversed into an image, then splits into three cryptographic shards. No single shard means anything alone.
4
Signed authorization — bank to bank
A one-time signed token authorizes exactly this payment. Money moves from your bank to the merchant bank; a public proof hash lands at verify.rostopay.com.
THE FACE TOKEN

What the biovital token includes

It is not a picture of your face — it is a living signature: six signals fused into one irreversible cryptographic identity.

Facial geometry
Thousands of spatial measurements of your face, reduced to encrypted math — never an image.
rPPG pulse
Your live heartbeat, read optically from micro color changes in your skin — proof of a living person.
Micro-movements
Involuntary eye and muscle micro-patterns unique to you — impossible to script or replay.
Depth map
3D structure of your face — flat screens, prints and masks fail instantly.
Device binding
Sealed to your device’s secure enclave — the token is useless anywhere else.
Voice token — VRC anti-coercion
Voice resonance check crossed with your BPM and breathing pattern — stress, duress and coercion signatures block the payment before it exists.
ANTI-DEEPFAKE

Why deepfakes don’t work here

Generative AI can clone your look and your voice — it is already fooling banks that rely on selfies and video calls. That is exactly why rostopay does not trust images.

A deepfake has no pulse. A screen has no depth. An injected video stream has no attested camera. Our liveness engine demands all three — live rPPG blood flow, true 3D structure and hardware-attested capture — signals that generative models cannot fabricate through a lens.

Printed photoREJECTED — no depth, no pulse
Replayed videoREJECTED — no live rPPG
3D maskREJECTED — no blood flow, no micro-movement
AI deepfake / injectionREJECTED — no attested camera
You, alive, presentVERIFIED ✓
FIVE BARRIERS
0.000001%

chance of fraud

Each barrier multiplies the last. To defraud a rostopay payment, an attacker would need to beat all five at once — including physically holding your device while being you, alive. That compound probability rounds to one in a hundred million.

1
Biometric match
Encrypted facial geometry must match your template.
1 in 10⁶
2
Biovital liveness
Live rPPG pulse + micro-movements prove a living you.
× 1 in 10³
3
Anti-deepfake & injection defense
Depth, texture forensics and attested camera reject synthetic media.
× 1 in 10³
4
Risk engine
Limits, velocity, coercion and behavior checks on every payment.
× 1 in 10²
5
The device itself
The final barrier is physical: shard 1 lives in your device’s secure enclave. No device, no payment — period.
HARD STOP
SIDE BY SIDE

Advanced biometrics vs legacy biometrics

We don't verify photos. We verify live people. The difference is every row below.

CAPABILITY
LEGACY BIOMETRICS
ROSTOPAY ADVANCED BIOMETRICS
What is compared
✗ A stored photo vs a new photo — image matching
✓ Living signals: geometry + pulse + micro-movement + depth, fused
Where your face is stored
✗ Photo/template on company servers — a honeypot for breaches
✓ Nowhere. Irreversible math, sharded 3 ways, sealed to your device
Liveness
✗ Blink tests and head turns — scriptable, replayable
✓ Biovital rPPG blood flow — a deepfake has no pulse
Deepfake resistance
✗ Fooled by high-res video, injection attacks and 3D masks
✓ Depth forensics + attested camera + live pulse reject synthetic media
Coercion protection
✗ None — a face is a face, willing or not
✓ Duress and stress patterns block the payment
If the vendor is breached
✗ Your biometric template leaks forever — you cannot change your face
✓ Nothing to leak: no photos, no reconstructable templates held anywhere
What it authorizes
✗ Unlocks a session — then secrets (cards, tokens) do the paying
✓ Signs the payment itself: one-time, amount-bound, bank to bank
3-SHARD CRYPTOGRAPHY

One template. Three shards. Zero reconstruction

Your encrypted template is split so that no party — not your device maker, not Sieve, not even rostopay — can rebuild it alone. Only your live face reunites the math, for one payment, one time.

Shard 1 — your device
Sealed in your device’s secure enclave. Never syncs, never uploads.
Shard 2 — your vault
Encrypted in your facewallet, controlled by you. Deleting it destroys the whole.
Shard 3 — attestor
A blind verification shard at Sieve. It can confirm a match happened — it cannot see or rebuild your face.
NON-CUSTODIAL

Everything stays with you

We cannot touch your account
Bank access is a scoped, consent-based authorization via Plaid — payment initiation only, fired exclusively by your live face. rostopay cannot see your balance, cannot withdraw, cannot freeze.
We hold no money
There is no rostopay balance, wallet or float. Funds move directly from your bank to the merchant’s bank over regulated rails — we only carry the message.
We keep no data
Identity, addresses and bank links live encrypted in your facewallet, with you. Merchants get attestations and trackable codes — never your raw data.
No photos, anywhere
No image of your face is ever stored — not on our servers, not on your device. Only irreversible encrypted math, useless without your live presence.
One scan, one payment
Every authorization token is single-use and amount-bound. Intercepting it is worthless — it cannot be replayed, reused or altered.
Publicly verifiable
Every transaction carries a Sieve ID + proof hash anyone can check at verify.rostopay.com — full auditability with zero personal data exposed.
SECRET-BASED (CARDS & PASSWORDS)
✗ A number anyone can copy is "you"
✗ Stolen once, abused anywhere
✗ Databases of secrets waiting to leak
✗ Chargebacks, fraud tooling, 3DS friction
PRESENCE-BASED (ROSTOPAY)
✓ Only you, alive and present, can pay
✓ Nothing to steal, skim or phish
✓ No secret databases — nothing to leak
✓ Cryptographic proof on every payment

Want the audits and architecture?

SOC 2 reports, compliance mapping and the full legal picture.

Trust & compliance → Enroll now →

Explore rostopay

Online cash payment, biometric checkout and pay-with-your-face resources.