1. Vendor and Product Reality
Trulioo, founded in 2011 in Vancouver, is the dominant global identity-data orchestrator in the regulated digital onboarding market. Its GlobalGateway platform aggregates identity data sources across more than 195 countries, routing verification requests to jurisdictionally appropriate sources and normalizing heterogeneous responses into a consistent verification verdict. Where regional KYC vendors integrate a handful of national bureaus, Trulioo integrates the long tail: civil registries, electoral rolls, credit bureaus, mobile network operators, utility databases, government identity issuers, and watchlist providers, with localized routing logic for each jurisdiction's regulatory and data-source landscape.
The product surface is a single API that accepts a normalized identity payload, name, date of birth, address, document number, optionally a photograph and a phone number, and returns a verification result with source attribution, jurisdictional context, and watchlist screening. Behind the API, the routing engine selects sources for the specified jurisdiction, executes parallel queries, applies source-specific normalization, and composes a multi-source confirmation score. Customers configure verification policy at the source level: require two of three sources to confirm, weight credit bureau higher than utility, escalate to manual review on partial match. The platform also bundles document verification, biometric matching (largely through partner technology), and ongoing AML monitoring, but its differentiated core is the global data-source mesh.
The customer base is concentrated in cross-border financial services, crypto exchanges, marketplaces, and remittance operators, businesses that need a single verification API capable of handling onboarding from any jurisdiction. Pricing is per verification with jurisdictional and source-tier adjustments. The regulatory positioning emphasizes coverage, audit trail, and source attribution: customers can demonstrate to regulators in any jurisdiction which authoritative source confirmed which attribute, when, and through what channel. Within its scope the product is operationally remarkable; integrating and maintaining hundreds of bilateral data-source relationships across heterogeneous regulatory regimes is a non-trivial commercial achievement, and the routing layer that abstracts it away from customers is genuinely valuable.
Analyst placement consistently lists Trulioo among the leading global identity-verification orchestrators alongside LexisNexis Risk Solutions, GBG, and Refinitiv. Its strength is breadth: there is no other vendor that returns a coherent verification across as many jurisdictions through a single integration. Trulioo is the reference implementation for what the industry calls "electronic identity verification" or eIDV, confirmation of claimed attributes against institutional records, and the verification event is constructed entirely around the question of whether the records confirm the claim.
2. The Architectural Gap
The structural property Trulioo's architecture does not exhibit is biological-trajectory continuity over the person presenting the identity. Every Trulioo check answers a record-existence question: do institutional databases contain entries matching the claimed attributes? The architecture is exquisitely engineered to answer that question across an enormous and heterogeneous data-source surface, but the question itself is a question about records, not about people. There is no architectural place in the platform where the biological identity of the person presenting the claim contributes to the verdict beyond the optional, single-point biometric add-on, and there is no place where prior verifications of the same person accumulate into a trajectory that informs the current check.
The gap matters because the dominant fraud pattern in cross-border onboarding has shifted from synthetic-identity fabrication to identity misuse. Fabricated identities, claims that do not exist in any institutional database, are exactly what record-matching is engineered to defeat, and Trulioo defeats them well. Misused identities, real attributes belonging to a real person, presented by someone who is not that person, pass every record check Trulioo can run, because every record exists. The fraud is not in the identity but in who is presenting it. A stolen credential package containing name, DOB, address, document number, and even a portrait will produce a clean multi-source confirmation, because each source confirms a real entry about a real person; the unauthorized presenter is invisible to the architecture.
Trulioo cannot patch this from within its current architecture because the platform was designed as a record-orchestration engine, not as a substrate of accumulated person-level observations. Adding more data sources does not produce trajectory continuity in the structural sense; bolting on a partner biometric does not produce trust-slope accumulation; introducing device-fingerprint signals does not produce biological identity in the primitive sense. The chain of reasoning the product runs is: claim received, sources queried, sources confirm, therefore admit. None of the three terms references the biological person, and none references prior interactions with that person. The pipeline shape is a record-confirmation orchestrator, not a person-continuity accumulator.
This shows up in concrete failure modes. Identity-package fraud, where stolen credentials are presented across many institutions in many jurisdictions, succeeds at every Trulioo check because every record query confirms genuine records. Cross-border identity misuse, a person verified through institutional records in one jurisdiction has no continuity relationship with their verification in another, because each verification is an independent database query, leaves a structural blind spot exactly where the fraud lives. Synthetic-identity fraud that uses real seed attributes plus fabricated overlays defeats record-matching when enough sources confirm the seed. The structural shape Trulioo lacks is the shape that would convert each verification into a contribution to the person's trajectory rather than a verdict about the person's records.
3. What the AQ Biological-Identity Primitive Provides
The Adaptive Query biological-identity primitive specifies three structural properties that together produce trajectory-based continuity validation. Property one is stable sketching and biological hashing: every biological capture is reduced through a stable sketching layer to a compact representation, from which a non-invertible, domain-scoped, temporally bound biological hash is generated. The sketch is engineered so that natural physiological drift maps to nearby points and substitution maps to distant points, while inversion of the hash back to the original biological signal is computationally infeasible. The specification pairs this with domain separation, so a hash minted for one relying party is structurally different from a hash for another and cannot be correlated across contexts, and with salt rotation, so the hash chain can be refreshed over time. Critically, the biological hash is not compared against a stored template; the system does not store raw biological data. Continuity is validated against the sequence of prior hashes for the identity, which places the design outside the template-storage posture that most biometric-storage regimes regulate.
Property two is trust-slope trajectory accumulation: every verification event contributes a sketch to the individual's trajectory, and the trajectory itself is the credentialed history. The slope of the trajectory, how quickly the sketch is moving and in what direction, is itself a signal. Slow, smooth movement consistent with aging and lifestyle change reinforces the trust slope; discontinuous jumps, oscillation, or movement inconsistent with prior segments produce trust-slope decay or a continuity break that flags substitution, sharing, or capture compromise. Trust slope is a graded, structured signal rather than a binary verdict, so a trajectory can be admitted at reduced weight, held for step-up, suspended, or recovered depending on accumulated evidence. Where continuity cannot be resolved through the standard validation process, the specification provides a quorum-based recovery path in which a policy-defined set of attesting peers, each validated against their own trust slope, re-establish the individual's chain without re-enrollment, preserving the accumulated history rather than discarding it. The specification is explicit that any biological state inference used along the way is non-diagnostic: it does not diagnose medical conditions and draws no clinical conclusion; the boundary between continuity inference and medical diagnosis is maintained structurally.
Property three is governed continuity composition across jurisdictions: the trajectory is admissible into downstream identity decisions through a published authority taxonomy that defines which counterparties may contribute observations, what evidential weight their observations carry, and how the trajectory composes when interactions span jurisdictions and operators. A bank's verification in London, a remittance operator's verification in Sao Paulo, and a government re-issuance event in Tokyo each contribute weighted observations under a credentialed authority, and the trajectory accumulates without any single operator owning the biometric template and without depending on cross-border database interoperability. The recursive closure is load-bearing: each trajectory update is itself a credentialed observation that downstream consumers can admit, weight, and act on. The primitive is technology-neutral and composes hierarchically (issuer, operator, jurisdiction, coalition), so a deployment scales by adding levels of the same trajectory rather than by re-architecting around each new regulatory regime. The specification further contemplates multiple identity resolution modes, one-to-one verification against a claimed identity, one-to-many resolution against a population index, and hybrid narrowing from a partial claim, with mode selection consent-gated rather than chosen unilaterally by the operator. The inventive step disclosed in United States Patent Application 19/647,395 is the biological-identity construct, a stable sketch and domain-scoped biological hash validated as an accumulating trust slope under governed, consent-gated composition, as a structural condition for continuity-based verification systems.
4. Composition Pathway
Trulioo integrates with AQ as a domain-specialized record-orchestration surface running over the biological-identity substrate. What stays at Trulioo: the global data-source mesh, the jurisdictional routing engine, the source-attribution audit trail, the watchlist and PEP screening, the localized regulatory-mapping work, and the entire account-management and customer-services commercial relationship. Trulioo's investment in record orchestration, bilateral source agreements across hundreds of providers, jurisdictional configuration, audit-grade source attribution, remains its differentiated layer and is not displaced by the substrate; record-existence checks remain the right defense against fabricated identities and remain a regulatory expectation under most KYC regimes.
What moves to AQ as substrate: the person-side of the verification, the biometric capture, optional behavioral signals, and any prior interactions, is reduced at the edge to a stable sketch, the sketch is admitted as a credentialed observation under the customer's or coalition's authority taxonomy, and the sketch contributes to an accumulating trust-slope trajectory rather than to a one-shot match score. The integration points are well-defined. Trulioo's API extends to accept and emit trajectory state; the GlobalGateway routing engine consumes the trajectory as an input to its current verdict logic, so a clean record match plus a degraded trajectory produces a graduated outcome (step-up, defer, conditional admit) rather than a binary pass; and trajectory updates flow back to the substrate as lineage records that survive the customer's vendor relationship with Trulioo.
The composition resolves the genuine-attribute attack surface directly. An identity package presented by an unauthorized holder produces clean record matches, but no accumulated trajectory under the legitimate holder's authority taxonomy, so the trust slope is undefined and the substrate emits a graduated outcome calling for step-up rather than a clean admit. Cross-border continuity emerges naturally: a customer's trajectory accumulated through a UK bank composes with their trajectory at a Brazilian remittance operator and a Japanese exchange under the same authority taxonomy, without any of the three depending on cross-border database interoperability that the underlying institutional sources cannot provide. Drift across jurisdictions and over years is treated as expected evolution rather than as a failed match.
The new commercial surface for Trulioo is global continuity-as-substrate for cross-border customers that need verification capable of detecting genuine-attribute misuse and that need biometric-data minimization sufficient to navigate GDPR, BIPA, India's DPDP Act, and the patchwork of biometric-storage regimes that currently force vendor-by-vendor accommodation. The trajectory belongs to the customer's authority taxonomy rather than to Trulioo's database, which paradoxically makes Trulioo stickier, the customer's continuity is portable, but Trulioo's data-source mesh and jurisdictional routing are what differentiate access to that substrate.
5. Commercial and Licensing Implication
The fitting arrangement is an embedded substrate license: Trulioo embeds the AQ biological-identity primitive into GlobalGateway and sub-licenses trajectory participation to its enterprise customers as part of the verification subscription. Pricing is per-credentialed-trajectory or per-sketch-contribution rather than per-verification, which aligns with how cross-border customers actually want to consume continuity, as an accumulating, jurisdiction-agnostic asset rather than as a stack of disconnected national checks.
What Trulioo gains: a structural answer to the genuine-attribute misuse pattern that record orchestration cannot close on its own; a defensible position against the wave of regional eIDV competitors and against in-platform competition from cloud-hyperscaler identity products; biometric-data-minimization posture that converts a regulatory liability into a regulatory advantage under the increasingly fragmented global biometric-storage landscape; and a forward-compatible footing as cross-border AML and CTF regimes converge on credentialed-lineage requirements rather than per-jurisdiction record snapshots. What the customer gains: portable continuity across jurisdictions and operators, detection capability that genuine-attribute misuse does not defeat, and a single trajectory spanning onboarding, transaction-time step-up, and periodic re-verification under one authority taxonomy regardless of which national database mesh underwrote the original record check. Honest framing, the biological-identity primitive does not replace eIDV; it gives eIDV the trajectory substrate it has always needed and never had.
6. Disclosure Scope
The inventive subject matter described here, identity as an accumulated trust slope over biological and behavioral continuity, stable sketching and non-invertible domain-scoped biological hashing with salt rotation, one-to-one, one-to-many, and hybrid resolution modes under consent-gated selection, non-diagnostic state inference, governed trajectory composition across operators and jurisdictions, and quorum-based recovery without re-enrollment, is disclosed in United States Patent Application 19/647,395. A skilled implementer could build the approach from that disclosure: reduce each biological capture to a stable sketch, mint a domain-separated, temporally bound biological hash without retaining raw biometric data, validate the hash for continuity against the prior hash sequence to derive a graded trust slope, and admit or weight the resulting trajectory through a published authority taxonomy. The design is intended to be broad across embodiments, including varied biological and behavioral modalities, cross-modal fusion, single-operator and coalition deployments, and edge or server-side sketch generation.
All references to Trulioo, GlobalGateway, and other named vendors, programs, and regulatory regimes (GDPR, BIPA, India's DPDP Act, and comparable frameworks) are external context describing the market the invention is positioned within. Those descriptions are provided for comparison only and are not claims of United States Patent Application 19/647,395. Named products are described at the architecture level from publicly known behavior; nothing here asserts a specific vendor's false-match rate, storage practice, or regulatory status.
