Identity Verification
The Vurto Private Contract asks for an identity verification, done by Didit, the same kind of check crypto cards and exchanges ask for. Swap, Send and Receive work without it.
Who Needs It
| Who | When |
|---|---|
| Whoever pays through the private contract | Before the deposit |
| Whoever receives through the private contract | Before withdrawing, on the site |
| Everyone else | Never |
The receiver is asked at withdrawal time, not at deposit time, so a payer cannot use a deposit to find out whether some other wallet has a verification. Agree on it with the receiver before sending.
Why It Is Needed
Anti-money-laundering and sanctions rules require it. Keeping illicit money out also protects everyone's funds, since issuers can freeze tokens in a vault used for crime.
Step By Step
- Connect and sign in. On the site, connect the wallet you will use and sign in.
- Open the verification. Click Verify My Identity. You go to a Didit page.
- Send your document and selfie to Didit. They go directly to Didit, not to Vurto.
- Come back. Didit sends you back to the site, and the result shows there. While it is in review, the screen checks again every minute.
An approved verification is valid for up to one year, and never past your document's expiry date. After that, verify again.
What Vurto Keeps, And How
| Data | Where It Stays |
|---|---|
| Document photo and selfie | With Didit. Vurto never stores a photo, a selfie or a video. |
| The result, and your details: name, birth date, nationality, document, country, expiry, address | On Vurto's server, encrypted before it is stored. |
| The link between your wallet and your verification | On Vurto's server, never with the wallet address in plain text. |
- Encrypted with a key that is not on the server. Each record is encrypted with AES-256-GCM, and that key is wrapped with a 4096-bit RSA key. The server only holds the public half, which can lock and not open. The private half stays offline, and is used only to answer a legal request. No route of the site returns personal data.
- The wallet is not in the table. It appears only as an HMAC-SHA256 mark, made with a secret that lives in the server.
- Didit does not get your wallet from the verification. It gets a derived mark instead. When a paid wallet analysis runs, Didit receives only that wallet's address and network, never who it belongs to.
- Dates by the day. The verification table keeps the day, not the hour.
Vurto's database and Didit's can be linked by the verification session, which both keep. The protection is that your identity is not readable from Vurto's database alone, not that the link cannot exist. Vurto knows which wallet belongs to which verification, and shares it only when the law requires, like a court order or a mandatory report to the U.S. government on a sanctioned person.
More Wallets, One Verification Coming Soon
A verified wallet will be able to link other wallets of the same person. Each new wallet pays a Merkle Science analysis ($0.40) and has to be clean. The server keeps only the wallet's mark, its family, its last four characters and the date, never the address.