ProntoConfirm lets a platform confirm that the person on the other side of a transaction holds a verified ProntoID account — and receive a durable reference for them instead of their identity.
You hold a reference. ProntoID holds the identity. If a dispute later requires the two to be connected, there is a process for that — and it does not depend on you having collected anything.
{
"confirmed": true,
"reference": "pcf_4c8e1b7d3a6f2049",
"confirmed_at": "2026-08-08T09:41:22Z",
"returning": false,
"claims": {
"over_18": true
}
}
// no name · no document · no biometrics
Platforms that want to know who they are dealing with usually end up collecting identity documents from everyone — and then owning the consequences of holding them.
A card number and an email address are not a person. When something goes wrong — a chargeback, a leak, harassment, a fraudulent claim — the record points at an account, and the account points at nothing.
Collecting ID from every buyer solves accountability by creating a breach liability, a retention obligation and a conversion problem. Assurance and privacy end up pulling in opposite directions.
By the time a claim surfaces, the session is long gone. What survives is whatever was recorded at the moment of the transaction — which for most platforms is an IP address and a timestamp.
ProntoConfirm splits the two apart. You hold the reference. ProntoID holds the identity. Accountability without custody.
Your platform — or an individual seller on it — marks certain actions as requiring a confirmed counterparty. A purchase, a booking, a first contact. Everything else stays open.
A hosted ProntoID surface appears. Returning users confirm in seconds. First-time users complete document capture and liveness inline, then continue without leaving the flow.
The verified identity stays where it already is — with ProntoID, as independent data controller. Nothing about who this person is crosses into your systems.
Your backend receives a signed assertion carrying a durable, platform-scoped reference and the confirmation timestamp. Attach it to the order. Keep it as your record.
Each confirmed person resolves to a stable, opaque identifier scoped to your platform. The same buyer returning next month resolves to the same reference, so orders, entitlements, history and enforcement decisions can all be attached to it.
Two platforms both using ProntoConfirm receive different references for the same individual. Correlating a person across services is not the default and is not something a platform can enable on its own.
Under GDPR Recital 26, pseudonymised data that can be attributed to an individual with additional information remains personal data. ProntoConfirm is designed to reduce what you hold and how re-identifiable it is — it does not place your processing outside the regulation, and we do not call the reference anonymous.
Most of the value of ProntoConfirm is that resolution is never needed. People behave differently when anonymity is not on the table. But when a dispute is real, the record is not a dead end.
The identity behind a reference sits with ProntoID, which determines the purposes and means of that processing in its own right. It is not your record held on your behalf, and it does not disappear when your platform does.
Resolution follows a published disclosure process — lawful requests from competent authorities, and platform requests meeting a stated evidential threshold. It is not available on demand, and a platform cannot compel it commercially.
Users are told at the moment of confirmation that a reference can be resolved, and on what grounds. Nothing about the arrangement depends on the user not understanding it.
Every confirmation is returned as a detached signature over a canonical payload, signed with a key held in AWS KMS. You can verify months later that the confirmation you are relying on is the one that actually occurred.
A confirmation records that a verified individual completed a check at a moment in time. It is not a character reference, a guarantee of conduct, or a promise that ProntoID will disclose an identity on request. Disclosure is governed by a published process and by applicable law, and the decision rests with ProntoID as independent controller — not with the platform relying on the reference.
Confirmation can be a one-off attached to a single purchase, or the moment an account comes into existence. Most platforms start with the first.
No account required. The buyer confirms at the point of purchase and the reference is attached to that order. Ideal where the platform hosts one-off transactions between people who have never met.
The reference becomes the account. Users register through ProntoConfirm and the platform never operates a password store, never issues a duplicate account, and never holds a name it did not need.
ProntoConfirm is how a reference comes into existence. ProntoMatch is how you check, later, that the person in front of you is still the one it belongs to.
A person you have no record of confirms a verified ProntoID account. You receive a reference and store it against the order or the account.
You already hold the reference. A selfie is matched against the identity on record to authorise a login or a sensitive action. You get a decision, not a new identifier.
Drop the widget where the moment happens. When confirmation completes, ProntoID posts a signed result to your endpoint — verify the signature, store the reference against the order, continue.
<!-- confirm the buyer at checkout --> <div id="pronto-confirm" data-context="purchase" data-order="ord_88213"></div> <script src="https://verify.prontoid.com/confirm.js"></script>
# your webhook endpoint result = prontoid.confirm.verify(request.body) if result.confirmed: order = orders.get(result.context.order) order.buyer_reference = result.reference order.confirmation = result.signed_payload order.release()
A creator selling work directly can require that purchasers are confirmed individuals. If content is later leaked or a payment reversed, the sale is tied to a reference rather than to a disposable email address.
Where a listing carries real counterparty risk, confirmation raises the cost of anonymity without turning the marketplace into a document collection exercise.
A signed confirmation at the moment of purchase is evidence that a specific verified individual authorised the transaction — retained by you, resolvable through ProntoID if a representment requires it.
Because the reference is stable for a given person on your platform, a removed user cannot simply return with a new email address — and you achieve that without ever holding their identity documents.
Gate messaging or introductions behind confirmation, so both sides know the other is a verified individual who can be identified if the interaction goes badly wrong.
Where a no-show, a damaged property or an on-site incident creates real cost, confirmation gives the operator a counterparty record without collecting a passport scan at booking.
ProntoConfirm answers a narrow question well. It is not a substitute for regulated onboarding, and it certifies nothing about a person beyond the fact of a verified account.
| Product | Question it answers | What you get back |
|---|---|---|
| ProntoConfirm | Who is this new counterparty, to a reference? | Issues a durable platform-scoped reference |
| ProntoMatch | Is this the same person as the reference on record? | Returns a match decision |
| KYC for Business | Who is this person, to a regulated standard? | Identity attributes and an audit record |
| Age Verification | Is this person over a threshold? | An age assurance decision |
| ProntoDeliver | Is the right person downloading this file? | A gated download and delivery proof |
| ProntoTag | Did this person consent, provably? | A sealed consent instrument |
ProntoConfirm is built to fit into compliance programmes across several regimes. It does not, on its own, make any platform compliant — regulatory responsibility for a service remains with its operator.
ProntoID determines the purposes and means of the identity processing it carries out and acts as an independent data controller, not as your processor. Your platform is the controller of the reference and everything you attach to it. Both roles need to appear in your privacy notice.
ProntoConfirm is an embeddable Login with Pronto widget. When someone reaches a moment that matters — a purchase, a booking, a first message — they confirm a verified ProntoID account. The platform receives a durable pseudonymous reference for that person rather than their identity.
ProntoConfirm creates a binding where none existed: a new counterparty arrives and the platform receives a reference for them. ProntoMatch checks a binding that already exists: the platform holds a reference and asks whether the person presenting themselves is the same individual. ProntoConfirm issues the reference; ProntoMatch re-verifies it later.
A stable, opaque identifier derived per platform. The same person returning to the same platform resolves to the same reference, so records, entitlements and history can be attached to it. Two platforms both using ProntoConfirm receive different references for the same individual.
By ProntoID, yes — that is the point of holding it. By the platform, no. Resolution happens only through a defined disclosure process, on grounds set out in advance, and users are told at the moment of confirmation that this is possible. A platform cannot resolve a reference on demand or at will.
Yes. Under GDPR Recital 26, pseudonymised data that can be attributed to an individual with additional information remains personal data. ProntoConfirm is designed to reduce what the platform holds and how re-identifiable it is; it does not place the platform outside the regulation, and we do not describe the reference as anonymous.
No. Document capture and liveness analysis happen inside ProntoID's own environment. Biometric templates, document images and identity attributes are never transmitted to, stored by, or retrievable by the integrating platform. ProntoID acts as an independent data controller for that processing.
The widget offers inline enrolment. A first-time user completes document capture and a liveness check in the same flow, then continues. Returning users see a single confirmation prompt and are through in seconds.
Yes. Confirmation is a policy the platform sets, and it can be delegated further — for example, letting an individual seller decide that only confirmed buyers may purchase their work, while the rest of the marketplace stays open.
Add Login with Pronto to the moments that carry risk — and get a record worth having, without adding a single identity document to your infrastructure.
Sandbox available · Swiss-operated · Independent data controller