ZOREAL Identify

Alternatives to Entrust IDV (Onfido)

Entrust Identity Verification, formerly Onfido, runs document, chip, biometric and device checks in Workflow Studio journeys and returns clear or consider results to the client; its NFC read performs passive authentication against country certificates and, where the document supports it, active authentication, and the service is certified under ETSI TS 119 461 and the UK DIATF. ZOREAL Identify is a "Continue with ZOREAL" sign-in on standard OpenID Connect, backed by a credential the person holds in the ZOREAL ID app after a document chip read, a face match and a liveness capture. This page sets the two side by side on mechanism, who holds the result afterwards, what each costs and how data is handled.

Information last reviewed 10 September 2026. Compared: the Entrust Identity Verification platform (Document report, NFC for Document report, Facial Similarity, Known Faces, Device Intelligence, Workflow Studio) with ZOREAL Identify. Entrust’s watchlist, proof of address and electronic signature products, and its PKI, HSM and card-issuance businesses, are out of scope.

See ZOREAL Identify

35 other alternatives

Where ZOREAL Identify and Entrust IDV (Onfido) differ

The guarantee
ZOREAL guarantees that the person is real, is not an AI, exists, and is linked to a government-issued ID. One hundred percent, not ninety-nine point nine. ZOREAL is the only solution in the world today that can give that guarantee.
The same chip checks, then different hands
Entrust reads the eMRTD chip in its mobile SDKs, unlocked by BAC or PACE, runs passive authentication against signed country certificates and active authentication where the document supports it, and binds the chip photo to the user through its Facial Similarity reports; the clear or consider result goes to the client workflow. ZOREAL re-runs passive authentication on its server from the raw Security Object against a trust store built from the ICAO Public Key Directory, has the chip prove possession of its private key, face-matches a liveness capture against the chip portrait, and issues the credential to the person, who logs in with it at every relying party.
What a verification costs
Entrust publishes no price list for identity verification: entrust.com/pricing/ (where onfido.com/pricing redirects) and the contact-sales page returned HTTP 403 on 10 September 2026, and the practice statement, ETSI terms and developer portal carry no fee schedule. ZOREAL: Free to enrol; Tier A logins free and unlimited on every plan and never charged; only a Tier B login, where identity disclosure is requested, is charged on Premium. Current prices are on the ZOREAL price list at zoreal.com/pricing.
Scheme certifications on file
Entrust states certification against "ETSI TS 119 461 (v1.1.1)" and "ETSI EN 319 401" as an identity proofing service provider under eIDAS, UK DIATF profiles M1A, H1A and H2B, SOC 2 Type II, ISO 27001 certificate IS 660122, and that "Facial Similarity Motion is iBeta PAD Levels 1 and 2 certified on both iOS and Android"; the developer portal’s ETSI page shows a certificate valid until 31 May 2025 and a later date was not found on the pages read. Organization-level, as zoreal.com lists them for Bynn Intelligence, Inc.: SOC 2 (attestation), PCI DSS (SAQ A), GDPR (data protection), ISO/IEC 27001:2022 (information security certification) and CSA STAR Level One (cloud security self-assessment). No Identify-specific certification or scheme recognition is stated on zoreal.com as of September 2026.

Side by side

Comparison of ZOREAL Identify and Entrust Identity Verification (formerly Onfido), based on public materials reviewed on 10 September 2026.

Attribute	ZOREAL Identify	Entrust IDV (Onfido)
How the identity is bound	Enrolment, in the ZOREAL ID app: the document is photographed, its machine-readable zone read and its chip read over NFC. The server re-runs Passive Authentication against its own trust store built from the ICAO Public Key Directory, so the issuing country’s signature over the data is checked on ZOREAL’s side, and the chip proves possession of its private key. A liveness capture with presentation-attack detection is face-matched 1:1 against the chip portrait. The device key is generated in the phone’s hardware, its attestation is verified at registration, and every evidence call carries an app-integrity assertion. Each verified document yields two holder certificates over that key under ZOREAL’s two roots (ECDSA P-384 and ML-DSA-87), one pseudonymous and one carrying the legal name, valid until the document expires. Login: ZOREAL is the OpenID Provider. The holder approves on their phone, a stock OIDC library validates the ID token against ZOREAL’s JWKS, the relying party sets the assurance per request with acr_values, max_age and prompt, and a request that cannot meet its floor is denied, never downgraded. The subject is pairwise per sector, so one ZOREAL ID is reused at every service without being linkable across them; consent is remembered per sector and re-prompted on any new scope.	Document: "automated analysis, powered by Atlas AI, classifies documents in milliseconds". NFC: eMRTD documents "contain a chip" read "using Entrust's mobile Identity Verification SDKs", unlocked by Basic Access Control from the MRZ or PACE, then "Passive Authentication - NFC data integrity authenticated against signed country certificates and revocation lists" and "Active Authentication - If supported by the document, NFC chip is also authenticated using the chip's private key"; "the photo extracted from the authenticated chip data is then bound to the user via our Facial Similarity Reports" (Photo, Video, or Motion, which requests "a simple head turn pattern in both directions or four randomized head movements"); Device Intelligence adds device signals (practice statement v1.5, December 2025; developer portal, September 2026).
What the relying party receives	Two halves. Proof that a real human is there: the ID token asserts this is one human (not one account, not one device), with the strength of that claim in a uniqueness field; that a government document chip was read and its authenticity verified, at the month given; and how this session was authenticated, in acr and amr, whether a live human was captured for this login, a registered device key was used, or a session was reused. And, when the relying party requests it and the person consents on the phone, the verified identity: name, birthdate and document details read from the chip, served from userinfo to a confidential client with a verified domain. The person sees every requested claim before approving, and the relying party receives only the scopes it was granted. It is not KYC, not a legal signature, not proof that the person consented freely, and not proof that the person is the one operating the browser.	Per-report results of "clear" or "consider" with breakdowns and extracted data, returned to the client that ran the workflow; clients "can also enforce that NFC verification is performed". A cross-client identifier or login product is not stated in the public materials we could read (pages read: practice statement, developer portal; entrust.com newsroom pages returned HTTP 403).
Guarantee	ZOREAL guarantees that the person is real, is not an AI, exists, and is linked to a government-issued ID. One hundred percent, not ninety-nine point nine.	Entrust states "Facial Similarity Motion is iBeta PAD Levels 1 and 2 certified on both iOS and Android with a perfect score of 0% False Acceptance Rate and 0% False Rejection Rate", and that NFC verification returns "a 95% pass rate on successful scans"; each report returns "clear" or "consider" rather than a guarantee, and under ETSI TS 119 461 and UK DIATF profiles Entrust acts as a certified identity proofing provider (practice statement v1.5; NFC for Document report; ETSI certified IDV page).
Who issues the credential	ZOREAL is the issuer of the ID card: a reusable identity credential that logs in to other websites, with the person controlling the scopes each login discloses.	No credential is issued to the person: report results belong to the client workflow, and Entrust describes "our role as a data processor of the data submitted by users". A reusable identity or login product is not stated in the public materials we could read (practice statement v1.5; developer portal).
Cost to enrol	Enrolment in the ZOREAL ID app is always free for the person holding the identity: document scan, chip read and liveness enrollment, re-enrollment, recovery and revocation. Every Tier A login is free without limit on every plan: the pairwise identifier, the assurance block, age-threshold answers and nationality, with 1 client configuration on Free. Answering an identity request is always free for the person.	No published price list as of September 2026: entrust.com/pricing/ (where onfido.com/pricing redirects) and entrust.com/contact-sales returned HTTP 403 on 10 September 2026, and the practice statement, ETSI terms and developer portal carry no fee schedule. No free tier, trial, minimum or set-up fee is stated on the pages we could read.
Cost per sign-in	Enrolment is free: "The ZOREAL ID app is always free for the person holding the identity, from enrollment to recovery", and "Document scan, chip read and liveness enrollment" is "Always free" on Free and Premium. Every Tier A login is free, without limit, on every plan: the pairwise identifier, the assurance block, age-threshold answers and nationality (openid, zoreal.age and zoreal.nationality, available to every registered client). Tier A logins are never charged. A charge applies only to a qualified Tier B login, where the relying party requests identity disclosure (the profile scopes, name, birthdate and document details, and email, which require a verified domain, a confidential client and client authentication), on Premium: "Identify · Identity disclosure", "Name, birth date and document details", "One charge for name, birth date or document details, even when several are returned"; "Identify · Fresh-liveness login", "Coming soon"; "Content and contract signing authorization", "Coming soon". Client configurations per website or app: 1 on Free, 10 on Premium; private-key JWT and mTLS client authentication on Premium. Premium is priced per user, monthly or yearly, with two months free on yearly billing; every organization member is a paid Premium seat; metered usage is charged separately. Enterprise: contact us. Answering an identity request is always free for the person. Current prices are on the ZOREAL price list at zoreal.com/pricing. ZOREAL Identify is the cheapest way to do KYC in the market: free to enrol, free to check, paid only for the higher disclosure tiers.	No published price per report or workflow run as of September 2026; the ETSI terms refer commercial terms to "the separate Onfido Services Agreement" (ETSI terms and conditions page).
Integration	Standard OpenID Connect from the provider at id.zoreal.com (discovery, JWKS, token and userinfo endpoints); any stock OIDC library validates the token. One client library per platform: @zoreal/oauth2-react, @zoreal/oauth2-js and @zoreal/oauth2-react-native on npm for the front end, and backends for Node (@zoreal/oauth2-node), Ruby (zoreal-oauth2), Python (zoreal-oauth2), PHP (zoreal/oauth2), Go, Java (com.zoreal:oauth2) and .NET (Zoreal.OAuth2). The React package renders the button and drives the flow itself, with no hosted script and nothing to allowlist in a Content Security Policy. Registration is self-serve in the dashboard (Identify, Assets): redirect addresses, origins and permitted scopes, with domain verification; personal-data scopes require a verified domain and a confidential client.	Smart Capture SDKs for Web, iOS and Android; "NFC is available via our iOS, Android, React Native and Flutter SDKs"; Smart Capture Link for a hosted link flow; Workflow Studio with "No code required"; a REST API, latest documented v3.6 (NFC for Document report; practice statement section 3.3; developer portal).
Data handling	The ID token carries no personal data, ever: a pairwise pseudonym per sector plus the assurance block. Name, birthdate, document fields and email are served only from userinfo, against a ten-minute single-audience access token with no refresh token, and only to a confidential client with a verified domain; a relying party that needs the data again asks the person again. Age is returned as registered yes-or-no thresholds, never an age or a birth year. The document portrait is a separately gated tier and is biometric data under GDPR Article 9 for the relying party that requests it. Consent is remembered per sector and re-prompted on any new scope or claim, and the consent screen shows only what ZOREAL verified about the relying party. ZOREAL, as the OpenID Provider, sees every login: which holder, which relying party, when.	Processor: "our role as a data processor of the data submitted by users". "Clients control how long Entrust retains their data (subject to maximum retention periods set by Entrust)", by ad hoc request or rolling deletion, and Entrust recommends clients do not delete within the first thirty days after a verification; under the ETSI terms, event logs are retained at the customer’s discretion "up to a maximum retention period of 3 years" (practice statement v1.5; ETSI terms and conditions).
Certifications and evaluations	Organization-level, as zoreal.com lists them for Bynn Intelligence, Inc.: SOC 2 (attestation), PCI DSS (SAQ A), GDPR (data protection), ISO/IEC 27001:2022 (information security certification) and CSA STAR Level One (cloud security self-assessment). No Identify-specific certification or scheme recognition is stated on zoreal.com as of September 2026.	"Onfido (now part of Entrust) is SOC 2 Type II compliant"; "ISO 27001 under certificate number IS 660122"; ISO 30107-3 PAD Level 1 for Facial Similarity Selfie and Levels 1 and 2 for Motion, iOS and Android, 0% False Acceptance Rate; ETSI TS 119 461 (v1.1.1) and ETSI EN 319 401 as an identity proofing service provider under eIDAS, covering Document Video Report, Facial Similarity Motion, Device Intelligence and Known Faces in Studio workflows; UK DIATF Identity Service Provider profiles M1A, H1A and H2B for Right to Work and Right to Rent. The ETSI page shows a certificate valid until 31 May 2025; a later date was not found on the pages read (developer portal; practice statement v1.5; ETSI certified IDV page).

Third-party details on this page reflect what each provider publicly stated on the review date shown above and may have changed since. Where a provider does not state something publicly, this page says so rather than assuming. Statements about what Entrust IDV (Onfido) offers reflect its public materials on the review date; absence of a feature from those materials does not mean it is unavailable. ZOREAL's current prices are on the ZOREAL price list.

Where ZOREAL Identify and Entrust IDV agree

Of the verification providers on this site, Entrust is the closest match on chip mechanics. Both read the eMRTD chip over NFC on the phone. Both check the issuing country’s signature over the chip data (Entrust’s passive authentication against signed country certificates and revocation lists; ZOREAL’s passive authentication re-run on its server from the raw Security Object against a trust store built from the ICAO Public Key Directory). Both have the chip prove possession of its private key where the document supports it (Entrust’s active authentication; ZOREAL’s active authentication challenge, and otherwise PACE-CAM or Chip Authentication). And both bind the chip portrait to a live face rather than to the printed photo.

Both also describe their results without a superlative. Entrust returns "clear" or "consider" with breakdowns and lets the client enforce that NFC verification was performed; ZOREAL’s token states in acr and amr the method that was actually used for this login and never smooths a weaker login into a stronger one. Both name the client, not the vendor, as the party that decides what is kept: Entrust states that clients control how long it retains their data, within Entrust maximums, and ZOREAL’s ID token carries no personal data, with identity attributes served only on request and consent.

Where they differ is what happens after the check, and who has audited it. Entrust’s result goes to the client that ran the workflow, under a services agreement with no published price, and the service is certified under ETSI TS 119 461 and the UK DIATF for regulated proofing. ZOREAL issues the credential to the person, who reuses it as a sign-in at every relying party with a different pairwise identifier at each sector, at a published price; no Identify-specific certification or scheme recognition is stated on zoreal.com.

ZOREAL Identify may fit you if

You want a sign-in rather than a check: a "Continue with ZOREAL" button on standard OpenID Connect that returns a pairwise pseudonymous identifier for a human verified against a government document chip
You want the person, not your database, to hold the credential, and to reuse it at every service without being linkable across them
You want published pricing with no sales call: free enrolment, every Tier A login free without limit, and a charge only on a Tier B login where you request identity disclosure
You want the assurance of each login stated in acr and amr, with a floor you set per request and a request that cannot meet it denied rather than downgraded

Entrust IDV may fit you if

You need regulated identity proofing under ETSI TS 119 461 or the UK DIATF (Right to Work, Right to Rent) with an audited practice statement
You need chip verification with passive and active authentication inside your own app, with image capture as the fallback
You need document coverage stated at over 2,500 documents in 195 countries and a no-code workflow builder
You need watchlist screening, proof of address or a qualified electronic signature on the same platform; ZOREAL Identify is not KYC

Other alternatives to Entrust IDV (Onfido)

35 more vendors compared under ZOREAL Identify, from their own public materials.

All 36 Identify comparisons

Common questions

For letting people sign in as a verified human, yes; for regulated identity proofing and KYC onboarding, no. Entrust runs document, chip, biometric and device checks in a workflow and returns clear or consider results to the client, under ETSI and UK DIATF certifications. ZOREAL Identify is a sign-in on standard OpenID Connect backed by a credential the person holds after a document chip read, a face match and a liveness capture. A business that needs both can run Entrust at onboarding and ZOREAL Identify at sign-in.

Entrust publishes no price list for identity verification as of September 2026; its pricing and contact-sales pages returned HTTP 403 on the review date and its practice statement and developer portal carry no fee schedule. ZOREAL Identify: Free to enrol; Tier A logins free and unlimited on every plan and never charged; only a Tier B login, where identity disclosure is requested, is charged on Premium. Current prices are on the ZOREAL price list at zoreal.com/pricing.

Entrust proves that a document passed its image classification or that an eMRTD chip passed passive authentication against country certificates and, where supported, active authentication, and that the chip photo was bound to a live face through a Facial Similarity report; the result is clear or consider per report. ZOREAL Identify proves that one human, not one account or one device, is signing in, that a government document chip was read and its authenticity verified at the month given, and how this session was authenticated. ZOREAL guarantees that the person is real, is not an AI, exists, and is linked to a government-issued ID. One hundred percent, not ninety-nine point nine. ZOREAL is the only solution in the world today that can give that guarantee.

No. ZOREAL’s product facts state: "It is not KYC, not a legal signature, not proof that the person consented freely, and not proof that the person is the one operating the browser." ZOREAL’s positioning statement reads: ZOREAL Identify is the cheapest way to do KYC in the market: free to enrol, free to check, paid only for the higher disclosure tiers. Both sentences appear on this page as ZOREAL publishes them. Entrust sells identity proofing certified under ETSI TS 119 461 and the UK DIATF, with watchlist and proof-of-address reports on the same platform; a business with a KYC or proofing obligation should confirm what satisfies it with counsel.

Close to it. Both unlock the chip from the machine-readable zone, check the issuing country’s signature over the chip data, and have the chip prove possession of its private key where the document supports it; both then bind the chip portrait to a live face. Entrust returns the result to the client workflow and lets the client require that NFC verification was performed; ZOREAL runs the checks at enrolment and issues the person a credential that logs in at every relying party afterwards.

How we compared

This comparison is based on publicly available information from Entrust IDV (Onfido)’s official website, documentation, pricing and published materials, and on ZOREAL’s own published product pages and pricing, as reviewed on 10 September 2026. Features, pricing and availability may change at any time. Verify current details directly with each provider before deciding.

Nothing on this page is legal advice. Which electronic signature method satisfies which law, what level of identity assurance a regulation requires, and whether a content signature or provenance mark meets a given standard all depend on the jurisdiction and the regulator’s guidance. ZOREAL Sign asserts no legal effect for the signatures it records. Confirm your obligations with qualified counsel before choosing a method.

Sources

Entrust Remote IDV Practice Statement & Security Policy v1.5 (December 2025) Read 2026-09-10
Entrust Identity Verification Developer Portal (product list, SOC 2, ISO 27001) Read 2026-09-10
NFC for Document report (SDKs, passive and active authentication, pass rate) Read 2026-09-10
Facial Similarity reports (Motion mechanism) Read 2026-09-10
ETSI certified IDV (standards, covered reports, certificate validity) Read 2026-09-10
Terms and conditions for ETSI certified identity verification (event log retention, services agreement) Read 2026-09-10
Entrust API reference (latest documented version) Read 2026-09-10
Entrust pricing page (onfido.com/pricing redirects here; HTTP 403 on the review date) Read 2026-09-10
Entrust contact sales (HTTP 403 on the review date) Read 2026-09-10
ZOREAL pricing (our own published claims) Read 2026-09-11
ZOREAL Identify product page Read 2026-09-11

ZOREAL is operated by Bynn Intelligence, Inc. and is not affiliated with, sponsored by, or endorsed by Entrust IDV (Onfido). Third-party names and trademarks are the property of their respective owners and are used only to identify the products being compared.

See ZOREAL Identify for yourself.

A product walkthrough, pricing or volume terms, with the ZOREAL team.