Confidential Biometrics
Confidential Biometrics is enabled by TACEO:Match, TACEO's service for biometric feature matching in MPC. No plaintext biometric data leaves the user's device or passes through a single party: biometric comparisons are evaluated directly on secret shares, so the underlying templates are never reconstructed by any node, any server, or TACEO itself.
TACEO co-architected the MPC protocol now running World's iris-code uniqueness system in production at global scale.
Why biometrics are different
Biometric data is unlike a password or a private key. You can rotate a key; you cannot rotate your iris or your palm.
- Irrevocable. A leaked template exposes a user forever. There is no equivalent of "change your password."
- Population-scale damage. Centralized biometric databases are a prime target for attacks.
- Device-only matching is limiting. Keeping templates on device protects privacy but blocks the cross-organization checks that matter most: uniqueness across a system, sybil detection, sanctions screening.
- Central servers break the trust model. Sending raw templates to a verification server means trusting that server completely, with data that can never be changed if that trust is violated.
Any architecture that solves these problems has to run the comparison without ever centralizing the template in plaintext.
How it works
The template is secret-shared on the user's device or on dedicated hardware before it is sent, and the comparison runs on the shares across independent nodes. Only the verdict is revealed — match or no match — and no node ever holds a usable fragment of the template.
Architecture, the distance functions involved, and the threshold model are documented under TACEO:Match.
What this enables
| Use case | Why MPC makes it possible |
|---|---|
| Population-scale uniqueness / sybil resistance | Compare against an enrolled set without centralizing templates or revealing which record matched |
| Cross-org deduplication | Organizations contribute to a joint check without sharing their underlying biometric data with each other |
| Anonymous identity verification | Prove a biometric matches an enrolled identity without revealing which identity |
Who should use it
Identity protocol teams building uniqueness systems, sybil-resistance infrastructure, or anonymous identity verification where templates cannot be centralized — proof-of-uniqueness systems, anonymous credential issuance, sybil-resistant voting.
Biometric verification providers offering cross-organization deduplication or uniqueness checks without requiring any party to hold the underlying templates — cross-border identity verification, fraud detection consortiums.
Enterprise developers running population-scale matching or eligibility screening across organizational boundaries, where centralizing sensitive biometric data is not acceptable.
Underlying service
Architecture, concepts and the matching function live under TACEO:Match in the TACEO Services section.
For adjacent reading: