Create your seed
The app generates a private seed inside your phone’s secure storage. HamsaID never sees it and keeps no copy.
How it works
Four layers.
One wave.
No whole picture.
A palm scan moves through four deliberately separated layers. Each knows only what it needs to do its job.
Step 0 · Enrolment
Enrol your hand. Approve each context.
Joining works the same way as verifying: the capture is transformed at the sensor and the raw frames are overwritten. What remains is an encrypted, context-bound template. Never a picture of you.
Enrol your hand
One wave at an enrolment sensor. The capture is transformed on the spot and the raw frames are overwritten, exactly as in daily use.
Approve your first context
Nothing works until you grant a permission: a place, a purpose, limits and an expiry that you control.
Enrolment steps and available permissions depend on the deployment.
The architecture
Raw biometric data never crosses a layer boundary.
Sensor / terminal
The sensor captures near-infrared palm-vein detail and 3D hand geometry in one gesture. It checks liveness locally, transforms the scan into a protected feature vector, then overwrites the raw frames before the next capture.
- Local liveness check
- Raw frames overwritten
- Transformed features only
Your phone
Your phone is the root of authority. It holds your private seed, records consent and issues narrowly scoped permissions. Your seed never leaves the device.
- User-held private seed
- Consent dashboard
- Revocation & expiry
Resolution core
Today, transformed templates are matched inside an attested confidential-computing enclave. They are encrypted at rest and isolated in per-context partitions. The target architecture distributes custody across legally separate operators using secure multi-party computation.
- Attested enclave
- Encrypted at rest
- Context-isolated
Relying party
The airport, stadium, bank or employer receives a signed result for one defined purpose: access granted, age verified or payment authorised. It does not receive the biometric, the seed or a global identity.
- Answer only
- Purpose-limited
- No global identifier
Inside the sensor
Raw capture exists for a moment. It is never retained.
The data path is deliberately one-way: raw NIR, RGB and depth frames are processed in volatile sensor memory, transformed for one context and overwritten before the next capture.
-
Live capture
Palm frames
NIR, RGB and depth, held in volatile memory only.
-
Edge processing
Quality and liveness
Presentation-attack detection runs locally and the readings become one fused embedding.
-
Transform
Bound to one context
The embedding becomes a cancelable query. The key stays protected and never travels with it.
-
Raw frames and the untransformed embedding are overwritten here. Only a context-transformed query continues to matching.
-
Resolution
Encrypted at rest
Only the transformed template is stored, encrypted, inside a per-context partition.
-
Output
A scoped result
Yes or no, for one purpose. No biometric and no global identifier leave the system.
Designed boundaries
No sensor knows the person. No venue sees the palm. No context sees another.
The current deployment combines local deletion, hardware isolation, encryption and context partitioning. The target architecture adds distributed custody so no matching operator holds a complete template.
Two authentication modes
Set the rules before you arrive, or confirm in the moment.
Mode A / hand only
Pre-authorised
Approve a context in the app in advance: the merchant, event, purpose, limits and expiry. At the terminal, the hand is enough. The phone can be off or absent.
- Caps and expiry
- Named contexts
- Revocable at any time
Mode B / phone mediated
Confirm in the moment
The terminal starts a challenge and the user confirms it on their phone. The consent is bound to that terminal, purpose and moment before the hand completes the session.
- Live consent
- Session-bound
- Signed result
Straight answers
The questions everyone asks.
Recovery
What if I lose my phone?
Existing pre-authorised contexts continue to work without your phone, until they expire or are revoked. Losing the phone does not automatically cancel them. Contact your deployment operator for help recovering the ability to manage your permissions.
The basics
Do I need my phone with me?
Only to set or change the rules. With a pre-authorised context, the hand alone is enough at the terminal.
Uniqueness
Can identical twins fool it?
The system compares palm-vein detail and hand geometry, rather than facial resemblance. Matching accuracy and resistance to presentation attacks are separate questions. Ask us about the test conditions and results relevant to your deployment.
Robustness
Does a cut or a bandage break it?
The sensor reads vein patterns beneath the skin in near-infrared light. Surface marks rarely matter, and a fully covered hand falls back to the venue’s normal process.
Your rights
Can I delete everything?
You can revoke permissions and request deletion of your enrolment. The operator can explain the deletion process and any applicable retention periods. Raw palm frames are overwritten at the sensor.
Operations
What happens if a scan fails?
The venue’s standard fallback applies: staff assistance or a document check, whatever the deployment defines. The fallback route is agreed with the operator for each deployment.
Operational answers vary by deployment. Ask us the harder versions in person.