Passwordless sign-in for websites & apps, powered by face recognition.
One script tag. Works with any webcam on every modern browser — liveness detection is included on every plan, with an optional voice factor when you need two.
Enroll users in seconds, authenticate them instantly, and keep the anti-spoofing layers other providers charge extra for.
Instant recognition with deep-learning face matching. No passwords, no OTP codes, no security questions — and ambiguous matches are refused, never guessed.
Passive anti-spoofing blocks photos, prints and screen replays; then a randomized three-gesture challenge — blink, turn your head, hold up a number of fingers — issued fresh every time, so a recorded video answers the wrong prompt. Every plan, every authentication.
Turn on a spoken second factor per application. After the face check, the user repeats a randomized phrase — Vultus matches both the words and their voiceprint, so a replayed recording fails. Off by default, one toggle to enable.
Frames are processed in memory and discarded. Only an encrypted template is stored, isolated per application, with a one-call GDPR delete API.
One script tag, two calls: enroll() and authenticate(). Plain JavaScript, zero dependencies, cross-browser. Webhooks keep your backend in sync.
Hosted on CYBERVIS UK infrastructure by default — or deploy the entire recognition layer inside your own network for total control over biometric data.
Every sign-in mints a short-lived signed token that your backend verifies with its application secret. The browser is never trusted on its own word.
Sign up on the Vultus Console, register your website, and get your public app ID and server secret instantly.
One script tag on your pages. No build step, no framework requirements — plain JavaScript and CSS.
Call enroll() with your own payload, then authenticate() to recognise the user and get it back.
Exchange the returned token against our API with your app secret, then create your own session as normal.
Once implemented, you'll be able to:
<!-- 1. Import the widget --> <script src="https://vultus.cybervis.co.uk/static/widget.js"></script> // 2. Initialize with your application public ID const vultus = new Vultus("vlt_your_app_id"); // 3. Enroll a new user (at signup) vultus.enroll({ payload: { userId: 123 } }) .then(info => console.log("Facial ID:", info.facialId)); // 4. Authenticate a returning user (at login) vultus.authenticate() .then(user => { console.log(user.facialId, user.payload); // 5. Verify user.token on your backend: // GET /api/token/verify (X-App-Secret header) });
Per account, per month. Liveness detection and encrypted template storage included on every tier — even the free one.
Built by a UK cybersecurity company, for companies that answer to regulators. Face templates are special-category data under UK GDPR — so here is exactly what happens to a face, step by step. Nothing is hidden.
Captured in the browser only for the few seconds of the check — never uploaded anywhere else.
Face matching and liveness run on the frames in RAM on the Vultus server.
No photo or video is ever written to disk or logs. There is no image to leak, subpoena or breach.
What remains is 512 numbers describing facial geometry. It is mathematically one-way — it cannot be turned back into a face.
The template is encrypted at rest and sealed inside your application's own vault.
Every enrollee's record — the face template and the profile payload your site attaches to it — is individually encrypted before it touches storage, and stays encrypted at rest.
Even someone holding the raw database files would see only ciphertext: no templates, no emails, no user IDs, and no way to tell who is enrolled.
Camera frames are analysed in memory and discarded. The stored template cannot be reversed into a photo.
A face enrolled on one customer's app can never be matched on another's. Hard sandbox, enforced server-side.
One authenticated API call permanently deletes an enrollee's template. Opt-out is a feature, not a ticket.
Azure UK South by default, TLS everywhere, secrets in managed configuration — or fully on-premise.
No. Vultus works with regular webcams and phone front cameras on all modern browsers. No fingerprint reader, depth sensor or FIDO key required.
No. Every authentication runs passive anti-spoofing that detects prints and screen replays, plus a randomized three-gesture challenge — blink, turn your head, and hold up a requested number of fingers — issued at that moment. A photo cannot respond, and a pre-recorded video answers the wrong prompt. For higher assurance you can enable the optional voice factor, which asks for a randomized spoken phrase and matches the enrolled voiceprint. Real-time deepfake injection is an industry-wide limitation; for high-risk actions we recommend stacking these factors, which is exactly how CYBERVIS's own products use it.
An encrypted mathematical template (not an image), the payload your site attaches, and a timestamp. If you enable the optional voice factor, an encrypted voiceprint (again, numbers — not an audio recording) is stored alongside it. Everything is AES-encrypted at rest and isolated per application.
Your choice. Use it as a second factor after passwords, as a passwordless primary login, or both. The token your backend verifies is the same either way.
Vultus gives you the technical controls GDPR requires for biometric data: explicit consent in the widget flow, minimal encrypted storage, per-application isolation, UK data residency and a deletion API. You remain the data controller; we act as processor — or go on-premise and biometric data never reaches us at all.
Open the Vultus Console, create a free account, register your application and your keys are issued instantly. The free tier includes 50 enrolled faces with full liveness detection.
Free tier to experiment. UK-built, liveness included, privacy by design.
Open the Vultus Console