Step 1
A scenario for the risk
In the KYC editor you choose the steps: document, Liveness, database checks, KYB by INN. For a trial period — a document, for a GPU and API — a document and Liveness.
Customer verification for hosting, AI services and digital platforms
A hosting provider issues a server, an AI service — access to generation and the API, a SaaS product — administrator rights, an app store — a payout to a developer. In every case an anonymous customer costs more than a check at the entry. We check a Russian passport or a foreign document, Liveness confirms a live person in front of the camera, and a company is checked by INN — in your registration and billing, alongside the identification the law requires.
Data is stored in Russia Russian software registry no. 19972 152‑FZ
Choose a service type: hosting, AI, SaaS, apps or domains
The card shows whom this service checks and what to connect for it. A detailed page for each service type will appear in this section.
Hosting, clouds, SaaS and apps
The customer, administrator and developer — before capacity, rights and payouts are issued.
- KYC · KYB · Liveness
Hosting and clouds
A customer of a VPS, cloud or GPU — before capacity is issued: an individual — by a Russian passport or a foreign one with Liveness, a company — by INN and its representative. A repeat check — when limits grow and on abuse complaints.
- KYB · KYC
SaaS and developer services
A corporate customer — by INN before the contract and deferred payment, an account administrator — passport and Liveness when rights are issued and access is recovered. A bug bounty participant — before the first payout.
- KYC · KYB · AML
App stores and developers
A developer and publisher — before publication: a company by INN, a representative — by passport, an individual — passport and Liveness. Before a payout — self-employed status and sanctions lists.
AI services, domains and websites
An organisation, user and seller — before access to the API, generation and a deal.
- KYC · Liveness · KYB
AI services and data labelling
An organisation — by INN before access to the API and increased limits, a user — passport and Liveness before an avatar or a clone of their own face. A labelling contractor — passport and self-employed status before a payout.
- KYC · KYB · AML
Domains and website sales
The administrator of a .RU and .РФ domain is identified by the registrar through Gosuslugi. The seller and buyer of a domain, website or online business — by passport, INN and sanctions lists before the deal and payout.
Hosting, AI, domains and biometrics: what the law requires of an IT service in 2026
There is no single law on checking IT service customers, and 115-FZ does not apply to hosting, clouds and AI services. But a hosting provider must identify a customer before issuing capacity, from 1 September 2026 a domain administrator is identified by the registrar through Gosuslugi, and nobody may use another person's image without consent.
NeuroVision checks the document, live presence and the company and records the date and result of each check. The method of identification under the law, consents and content labelling are the responsibility of you and your lawyer.
- Customer verification
Hosting and clouds: the customer before capacity is issued
149-FZ, Art. 10.2-1; Government Resolution of 29.11.2023 No. 2011.
What the law requires
- Computing capacity — only after the customer is identified or authenticated
- Operating without an entry in the register of hosting providers is not allowed
Ten methods under Resolution No. 2011
- Gosuslugi, the Unified Biometric System, a qualified signature, documents on a personal visit
- A transfer from an account, a bank card, the Faster Payments System, a mobile phone number
- The information system of the provider or another Russian company
New in 2025–2026
- Interaction with the state anti-fraud system
- A ban on providing capacity to owners of services giving access to blocked resources
What the check gives you
- A passport and a live person in front of the camera — where a phone and a card confirm only a phone and a card
- Deepfake protection
AI services and the digital likeness
243-FZ of 26.07.2026; Civil Code, Art. 152.1.
The AI law
- In force from 1 September 2026, the main obligations — from 1 March 2027
- Large platforms give the user the ability to label AI-generated content
Identification of users
- The AI law does not require it
- The service introduces verification itself — for the API, limits and generation from a face
Another person's image
- A citizen's image may be used only with their consent
- Protection of the voice — a bill, not adopted as of October 2026
- Face recognition and 152-FZ
Domains, biometrics and personal data
149-FZ, Art. 15.2 (as amended by 569-FZ); 572-FZ, Art. 15; 152-FZ, Art. 11, 18.
Domains .RU, .РФ, .SU
- From 1 September 2026 — registration and renewal only after the administrator is identified through Gosuslugi
- This is done by the registrar, not a third-party service
Biometrics outside the Unified Biometric System
- Identification and authentication by biometrics outside the Unified Biometric System are prohibited for organisations
- A lawyer assesses Liveness and face comparison in your scenario before launch
Consent and localisation
- Biometrics — only with written consent
- The data of Russian citizens is collected in databases on the territory of Russia
SaaS, app stores and domains: checks that already work now
For SaaS the risk is in the corporate customer and the administrator with broad rights, for an app store — in the publisher you pay, for a domain exchange — in the seller and buyer. There is no need to wait for a separate integration: the same checks work through one API.
-
A SaaS corporate customer
Company — by tax number: status, signs of a one-day company, courts and debts — before a contract with deferred payment.
The account administrator — passport and Liveness when owner rights are issued and access is recovered. -
GPU rental and bug bounty
A capacity tenant — passport and Liveness before the first launch; payment is accepted by your payment provider.
A bug bounty researcher — passport, INN and self-employed status before the reward is paid. -
A developer in an app store
A publisher company — by INN and a representative with a passport before the first publication.
An individual developer — passport and Liveness; before a payout — self-employed status and sanctions lists. -
A deal with a domain or website
The seller — passport, INN and sanctions lists before the payout, a company — by INN.
The buyer — a document and Liveness for a large deal. The domain administrator is identified by the registrar through Gosuslugi.
Registration, limits, payouts: at which step an IT service should check the customer
- Email and phone — for sign-in; most users do not need a document at this step
- A repeat registration for a new trial period — by the document data
- A document and Liveness — straight away, if the service gives away capacity or AI generation for free
- Identification of a hosting customer by one of the methods of Resolution No. 2011
- A Russian or foreign passport — is recognised from a photo, forgery and a screen photo — by the document anti-fraud check
- Liveness: a live person in front of the camera, not a photo, mask or deepfake
- A customer company — by tax number, a representative — by passport
- Payment by card or from an account — through your payment provider
- Access to the API, mass mailing, a GPU cluster or generation from a face — after the document is checked
- Liveness before generating an avatar or a clone of one's own face
- Labelling of AI-generated content — under the AI law
- An abuse complaint — a repeat check of the account owner
- A change of account owner and access recovery — a repeat KYC with Liveness
- A payout to a developer, researcher or contractor — self-employed status and INN from the passport
- OFAC, EU, UK and UN sanctions lists — before a payout abroad
- The contract, consents to the processing of data and images
- NeuroVision — covered by the NeuroVision check: document, Liveness, company by INN, database checks
- Your service — a step in your registration, billing and at the payment provider
- The law and a lawyer — the method of identification under the law, consents, labelling and contracts: decided by your lawyer
Whom to check: the customer, account administrator, payer, developer and contractor
In an IT service, different people stand behind one account: the one who registered, the one who pays and the one who manages rights. It is worth checking the role with the greatest capacity to do harm.
-
A customer — an individual
- A Russian passport or a foreigner's document — 16 000+ types from 195+ countries and territories
- Liveness and a check of the selfie for a deepfake and face substitution
- The document data — as fields into your system with no manual entry
-
A customer company and its representative
- Company by tax number: status, signs of a one-day company, courts and debts
- The representative — a passport with no manual entry and a check of its validity
- The director — against sanctions lists and the Rosfinmonitoring list
-
The account administrator
- A check when owner rights and access to billing are issued
- A repeat KYC on access recovery and a change of phone
- One person — one account with free resources — by the document data
-
The payer
- The document data — as fields into billing for comparison with the payment data on your side
- A photocopy, printout or screen photo of a document — by the anti-fraud check before the first payment
- A repeat check after a chargeback
-
A developer and contractor
- INN from the passport and self-employed status — before each payout
- Wanted lists, bankruptcy and enforcement proceedings — against the databases
- A foreign contractor — sanctions lists and PEP
-
Where NeuroVision ends: identity and company are ours, Gosuslugi, abuse control and the lawyer are yours
-
NeuroVision does
The document and a live person. A Russian or foreign passport, document anti-fraud, Liveness with protection against masks and deepfakes.
The company and the people behind it. INN, status, courts and debts, the director — against lists.
Checks before a payout. Self-employed status, sanctions, wanted lists — 5 ₽ each. -
What remains with you and the state
Identification under the law. Gosuslugi and the Unified Biometric System for hosting, Gosuslugi for domains — through state systems and your registrar.
Abuse control. Complaints, blocks, traffic and content monitoring — in your abuse department.
Consents and labelling. The texts of consents and the labelling of AI content are prepared by your lawyer. -
Not part of NeuroVision
VPN and proxy checks. We do not analyse the customer's network signs.
Voice and video calls. We do not check a voice clone or a substituted interlocutor in a call.
Moderation of generations. What the user does in the service after the check — outside the product.
We do not replace Gosuslugi, the domain registrar or your abuse department. We remove anonymity where you give away capacity, access to the API or money — and keep the date and result of each check.
Abuse schemes that hosting, clouds and AI services lose on
Phishing on a rented server
An IP range block
A server is registered to someone else's phone number, and a week later it hosts a phishing bank page. Neighbouring customers are caught by the block, and the account owner is unknown. A document and Liveness before the server is issued cut off disposable accounts.
A carousel of trial periods
Free resources go to mining and mass mailing
One person registers dozens of accounts for the trial balance. A repeat document check shows that the new customer is the old one.
Someone else's card when renting a GPU
A chargeback a month later
The capacity is paid with a stolen card, the resources are burned, and the bank returns the money to the card owner. A check of the document and a live person before the first launch reduces such losses.
An avatar from other people's photos
A claim and removal of the service from the store
A user uploads photos of another person and makes a digital clone of them. Liveness at the entry confirms that a live person is in front of the camera, and the consent of the person whose face is in the generation is obtained by the service itself.
Resale of a verified account
API access with an unknown person
A verified account with limits is sold on a forum. A repeat KYC on a change of device and access recovery shows who is now behind the account.
10.2‑1
The customer is known before issuing
AI services: the organisation, the live user and someone else's face in generation
A generative service gives away what is expensive: computation, access to models and the ability to create a person who was not in the frame. A check at the entry answers two questions — who gets access and whose face is in the generation.
-
The organisation before API access
A company is checked by INN, its representative — by passport and Liveness. Increased limits, model fine-tuning and access to closed features — only for a verified organisation.
-
The live user
Liveness tells a person in front of the camera from a photo, screen, mask and deepfake — with no tasks for the user. A bot farm and a bought account will find it harder to pass such a check.
-
One's own face, not someone else's
Before creating an avatar or a clone the service checks that a live person is in front of the camera, not a photo of someone else's face. The consent of the person whose face is used in the generation is on the service's side: other people's photos are not turned into a digital likeness without consent.
-
Data labelling contractors
A labelling platform checks the contractor by passport and self-employed status before a payout. One contractor — one account by document number and INN, with no pools under other people's documents.
Hosting and clouds: the customer is known before the server is issued, not after a complaint
A phone and a card confirm a phone and a card
Since 1 December 2023 a hosting provider works only with identified customers and only if listed in the Roskomnadzor register. The simplest methods — a phone number and card payment — do not show who rented the server. Where the risk is higher, a document and Liveness are added to them.
- 01
The method under the law is your choice
The provider chooses one of the ten identification methods of Resolution No. 2011. The passport and live presence check is built in alongside it — into the order panel or via a link.
- 02
A foreign customer
A foreigner often has no Russian card or number. A passport of 195+ countries and territories is recognised from a photo, and Liveness confirms that a live person is in front of the camera.
- 03
A customer company
A company is checked by INN before the contract, its representative — by passport. A one-day company with a mass director is visible before a dedicated server is issued on credit.
- 04
A repeat check by risk
Growing limits, an abuse complaint, a change of account owner — reasons to check the customer again, not to block at once.
How an IT service customer check works
Three steps from the 'Order a server' or 'Get API access' button to a decision in your panel. The user does not leave the order page, and the result returns to your billing.
Step 2
A check in the widget
The customer photographs the passport and passes Liveness in the Web SDK — on the website, in your app's WebView or via a link. The document, face and databases are checked in one session.
Step 3
A decision in billing
The session outcome, document fields and check results arrive in your system. Clean customers get the server at once, disputed ones go to a specialist.
What a solution for IT services is built from
A hosting provider, AI service or SaaS assembles its own set from six products of one platform. Connect only what you need — you pay for completed checks.
- Learn more
KYC verification
A document, selfie or Liveness and database checks — in one session, in your interface.
- Learn more
Liveness
Protection against photos, screens, masks and deepfakes when a customer is checked in front of the camera.
- Learn more
Foreign documents
Passports of 195+ countries and territories: fields, machine-readable zone, document anti-fraud.
- Learn more
Anti-fraud at registration
Repeat registrations and forged documents — before a trial period is issued.
- Learn more
Checking a company by tax number
Status, signs of a one-day company, courts and debts, 20+ checks of the director and founders.
- Learn more
Database checks
Self-employment, INN from the passport, wanted lists, sanctions — from 5 ₽ per check.
How much it costs to check a hosting, AI service or SaaS customer
Payment for completed KYC sessions and checks, with no subscription fee. A selfie and Liveness cost the same — the mode is chosen in the scenario.
- Enable
Document
from 16 ₽ per session
A Russian or foreign passport with an anti-fraud check: a screen photo, printout, editing in an editor. For a trial period and registration.
-
Everything from 'Document', Liveness with protection against masks and deepfakes, a check of the selfie for face substitution. For issuing a server, a GPU and API access.
- Get a quote
Extended
on request
A document, Liveness and checks against Russian databases in one session, KYB of a company by INN. For SaaS, app stores and payouts.
A check against one database — 5 ₽, international screening of sanctions and PEP — 36 ₽. An additional document in a session — 10 ₽. The first month — test access.
How to build a check into registration, billing and the control panel: Web SDK, API or a ready link
For a hosting provider and SaaS — a widget on the order page and the result into billing via the API. For an AI service with a mobile app — the same widget in WebView. For a large cloud — connection terms with a specialist.
Terms
- A 1-month trial period
- A dedicated manager
- Tickets-based technical support
- Payment for the checks performed
Why hosting providers and AI services choose NeuroVision
An IT service needs a check that does not hurt registration conversion and withstands the flow: thousands of orders a day, customers from different countries, bot and deepfake attacks.
A document, a live person and a company — in one session
A passport from 195+ countries and territories, Liveness and a company check by INN — one service and one contract. There is no need to stitch together OCR, biometrics and databases from three vendors.
One request instead of three vendors.
A Russian developer
A Skolkovo resident; the platform is entry no. 19972 in the Russian software registry.
Licences and certificates
The project «Development of a multimodal system using artificial intelligence "Neuromed" for managing the diagnostic processes of a clinic on the basis of the "Neurovision" computer vision platform» is supported by the Innovation Promotion Foundation within the federal project «Domestic Solutions»
The Neurovision computer vision platform is registered with Rospatent (certificate No. 2023661508) and included in the Russian Software Registry (entry No. 19972 of 13.11.2023)
The right to use the Platform is granted under a licence agreement concluded by Neurovision with its customers
Identification terms in hosting, AI and digital services
Briefly on the concepts that arise at customer registration, issuing capacity and checking an AI service user.
- Hosting provider
- A company that provides computing capacity for hosting information on the internet. In Russia it works only if listed in the Roskomnadzor register and only with identified customers.
- Computing capacity
- A server, virtual machine, cloud resources or GPU that the provider gives to a customer under a contract.
- Identification and authentication
- Identification is establishing who the customer is; authentication is confirming that it is them. For hosting, the methods are listed in Government Resolution No. 2011.
- Liveness
- A check that in front of the camera is a live person, not a photo, screen, mask or deepfake.
- Liveness detection
- Deepfake
- An image or video in which the face is created or substituted by a neural network.
- Deepfake
- Digital likeness
- An image, video or voice of a person created or altered with the help of AI. A citizen's image may be used only with their consent.
- Abuse
- Use of a service for phishing, spam, attacks or fraud.
- Abuse
- Trial abuse
- Repeat registrations for a free trial period or a bonus balance.
- Trial abuse
- KYB
- Checking a customer company: registration, directors, courts, debts and lists.
- Know Your Business
- A large foundation model
- An AI model trained on big data that solves many tasks. Its development and use are regulated by the 2026 AI law.
- Foundation model
Read also
User verification, deepfakes and biometrics protection — in our blog.
446 13
KYC, AML and Digital Identification
Deepfakes in KYC: Detecting Face Spoofing and Protecting Video Verification
369 28
KYC, AML and Digital Identification
Risk-based KYC: how to choose the verification level by risk profile
518 29
KYC, AML and Digital Identification
How Video Streams Are Spoofed in KYC: The Architecture of Attacks via Emulators, Virtual Cameras, and Video Stream Injection
384 16
KYC, AML and Digital Identification
How to ensure the protection of personal and biometric data in KYC processes
Questions about verifying IT service customers
So that capacity, API access, generation from a face and payouts go to a known person or company. Hosting must identify a customer by law, and other services check where an anonymous account brings losses: phishing, trial abuse, chargebacks, avatars from other people's photos.
Art. 10.2-1 of Law No. 149-FZ: it may operate only if listed in the Roskomnadzor register, and may provide capacity only after the customer is identified or authenticated. The rule has been in force since 1 December 2023. There are ten methods in Government Resolution of 29.11.2023 No. 2011: Gosuslugi, the Unified Biometric System, a qualified signature, documents on a personal visit, a transfer from an account, a bank card, the Faster Payments System, a mobile phone number, the information system of the provider or another Russian company.
No: they are not on the list of organisations in Article 5 of the law. The exception is if the service itself transfers money as a payment agent or operator. The checking of IT service customers is determined by the hosting law, the personal data law and your rules.
The passport and Liveness check is built in alongside the identification method from Resolution No. 2011 and shows who is in front of the camera — where a phone and a card do not show it. Whether it is suitable as a standalone method is assessed by your lawyer.
No. Law No. 243-FZ of 26.07.2026 regulates large foundation models and obliges large platforms to give the user the ability to label AI-generated content. User verification is introduced by the service itself — for API access, limits and generation from a face.
Before generation the user passes Liveness: this way the service knows that a live person is in front of the camera, not a photo or a deepfake. But Liveness does not settle the question of consent: using a citizen's image without their consent is prohibited by Art. 152.1 of the Civil Code, and the consent of the person whose face is in the avatar is obtained by the service itself.
As of October 2026 it is not: the bill on Article 152.3 of the Civil Code on protecting the voice has not been adopted. NeuroVision does not check the voice — only the face and the document.
No. From 1 September 2026 the administrator of a domain in .RU, .РФ and .SU is identified by the registrar through Gosuslugi. We check the seller and buyer in a deal with a domain or website — by passport, INN and sanctions lists.
A foreigner's passport is recognised from a photo — 16 000+ document types from 195+ countries and territories, Liveness confirms that a live person is in front of the camera. Which method of identification under the law to use for a foreigner is decided by your lawyer.
Place the check at the step where capacity, the API or a payout opens, not at registration. Liveness is one short capture in front of the camera, with no separate apps.
Through the Web SDK: it is connected to a website by a script or an npm package, opens in your app's WebView or via a unique link. The session outcome and document fields are returned through the API; the connection terms for large clouds are discussed with a specialist.
A document — from 16 ₽ per session, a document with Liveness — from 29 ₽, a database check — 5 ₽. There is no subscription fee, the first month is test access.
We will select checks for your hosting, AI service or platform
Tell us what you give the customer — a server, API access, generation or a payout — and how many registrations a month. We will build a check scenario and give test access.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a call
The company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
