How We Evaluate Biometric Software Vendors

By James Whitfield · Independent Researcher Published January 2026 Updated 2026-06-18 (v2.0)

This page documents how PrimeBiometry scores biometric authentication and identity verification vendors. All vendors are evaluated against the same five weighted criteria. Featured placements do not affect scores.

This is a shortlisting tool, not a professional audit. Use it to narrow your vendor list – then test the API yourself and consult a compliance specialist for binding regulatory decisions.

Evaluation Process

01

Candidate Screening

Vendor must have publicly accessible product documentation, a minimum of 10 user reviews across G2, Gartner Peer Insights, or Capterra, and an active website. Vendors are identified through category research and user submissions.

02

Data Collection

We check: vendor API reference and documentation, pricing page (or direct email outreach for unlisted pricing), public compliance certificates, review aggregation from G2, Gartner, and Capterra, and sandbox or trial availability.

03

Scoring

Each vendor is scored against five weighted criteria using sub-criteria. Scores are numeric. Sub-criteria within each criterion are summed to produce the criterion total. No rounding until the final score.

04

Publication and Monitoring

Assessment is published with a lastUpdated date. Re-review is triggered by quarterly pricing checks, semi-annual compliance certificate checks, major product releases, or user-submitted corrections.

How I cross-check vendor claims

  • Before scoring Integration Depth, I open the vendor's API reference and verify each claim against actual endpoint documentation. Marketing copy saying "webhook support" without a documented payload schema scores 0.
  • Compliance sub-criteria require a publicly accessible document or DPA template. Vendor self-attestation on marketing pages does not count.
  • I cross-check rating scores against at least 2 of the 3 sources (G2, Gartner Peer Insights, Capterra) before assigning User Sentiment points. A vendor with reviews on only one platform does not meet the 10-review minimum if the other platforms show none.

Scoring Criteria

Five criteria, each with a defined weight. Sub-criteria within each criterion are scored individually and summed. Total possible score: 100 points.

Compliance Coverage scores verify that public documents exist and match stated certifications. This is research-level verification, not a legal audit. For binding regulatory guidance – GDPR DPAs, HIPAA BAAs, SOC 2 scope reviews – consult a qualified compliance consultant.
20%

Compliance Coverage

20 pts

Verified against public compliance documents, not vendor self-attestation.

GDPR Valid DPA template on vendor website or available on request 4 pt
SOC 2 Type II Public audit report URL or third-party attestation dated within 24 months 4 pt
ISO 27001 Certificate with scope statement, dated within 3 years 4 pt
CCPA Data processing addendum or explicit CCPA statement in privacy policy 4 pt
HIPAA BAA availability plus at least one documented healthcare customer reference 4 pt
25%

Integration Depth

25 pts

Assessed from public API documentation and developer resources only.

REST API Public API reference with endpoint documentation and authentication model 5 pt
SDKs At least one native SDK (iOS, Android, or Web) with published documentation 5 pt
Webhooks Event-driven callback support documented with payload schema 5 pt
Sandbox Free trial or developer sandbox accessible without a sales call 5 pt
Docs quality API reference completeness, changelog, and error code reference 5 pt
25%

Market Coverage

25 pts

Geographic reach, document types, liveness detection capability, and biometric PAD certification.

Geographic reach Documented coverage of 50+ countries 5 pt
Document types Supports passports, national IDs, and driver's licenses at minimum 5 pt
Language support SDK or interface available in 3+ languages 5 pt
Liveness detection Graduated scale: basic active (selfie blink or turn checks) 1 pt, passive (no user action required) 3 pts, iBeta PAD L1 certified 4 pts, iBeta PAD L2 or ISO/IEC 30107-3 compliant 5 pts. 5 pt
iBeta PAD certification iBeta PAD Level 1 (active or passive PAD validated) 3 pts, iBeta PAD Level 2 (covers L1 attacks plus advanced presentation attacks) 5 pts. No certification scores 0 pts. 5 pt
15%

Pricing Transparency

15 pts

Published or directly quoted pricing only. No confidential enterprise figures.

Published tiers Pricing page with at least one publicly listed tier 5 pt
Per-verification pricing Cost-per-check model or volume pricing table visible 5 pt
Free tier or trial Sandbox access, free verification quota, or no-commitment trial 5 pt
15%

User Sentiment

15 pts

Aggregated from G2, Gartner Peer Insights, and Capterra. Minimum 10 reviews required.

Rating 4.7 or above Full 15 pts 15 pt
Rating 4.4 to 4.6 12 pts 12 pt
Rating 4.0 to 4.3 9 pts 9 pt
Rating 3.5 to 3.9 5 pts 5 pt
Rating below 3.5 1 pt 1 pt

Data Sources

01

Vendor documentation

API references, pricing pages, feature lists.

Limitation: Vendor-controlled. May be incomplete or outdated.

02

Vendor pricing pages

Direct outreach used when pricing is not published.

Limitation: Custom quotes may not reflect typical pricing.

03

Public compliance certificates

SOC 2 reports, ISO certificates, GDPR DPA templates.

Limitation: We verify existence, not scope depth.

04

G2, Gartner Peer Insights, Capterra

Aggregated rating only. Minimum 10 reviews threshold. Vendor-curated testimonials excluded.

Limitation: Review populations vary by platform.

05

Sandbox or trial environments

Checked for availability only.

Limitation: We do not perform hands-on API testing or evaluate accuracy benchmarks.

What We Don't Cover

Accuracy benchmarks

We do not run liveness detection or facial recognition accuracy tests. We do not have access to proprietary benchmark data. If accuracy matters for your decision, request vendor test reports directly.

Pricing negotiation outcomes

Listed pricing is what is publicly available or directly quoted. Actual enterprise pricing often differs after negotiation.

Live product demos

We do not request or conduct vendor demos. Assessments are based on public documentation only.

Post-integration support quality

We assess documentation and SDK availability, not real-world support responsiveness or SLA fulfillment.

Update Cadence

Quarterly

Pricing tiers and plan changes

Semi-annual

Compliance certification expiry checks

Annual

Full methodology review and weight recalibration

Ad-hoc

Major product releases, acquisitions, user-reported corrections

The lastUpdated date on each vendor assessment reflects when that specific assessment was reviewed, not this methodology page.

Independence Policy

PrimeBiometry is currently self-funded. In the future, the site may earn revenue through affiliate links and featured vendor placements. Affiliate relationships will not influence assessment scores.

Featured placements are labeled "Featured" and positioned above organic results in category pages. They do not affect scoring criteria or editorial conclusions. Featured status is assigned after scoring is complete.

Disputes: Vendors may submit factual corrections to support@primebiometry.com. Editorial conclusions are not adjusted based on vendor preference.

Found something wrong?

Work in compliance and see an error? Know that a vendor's pricing or certification changed? Email support@primebiometry.com with the vendor name, the field, and a source link. I investigate and update within 5 business days. Corrections are noted in the vendor's assessment changelog.

Reader corrections have already improved scores for 3 vendors. If you spot something, I want to know.

Frequently Asked Questions

Do featured vendors get higher scores?

No. Featured placement is a separate commercial arrangement. All vendors are scored against the same five criteria regardless of featured status. Scores are calculated before featured status is assigned.

How often are scores updated?

Pricing is reviewed quarterly. Compliance certifications are checked semi-annually. Full re-evaluations happen annually or when a major product change is announced.

Can vendors request a re-evaluation?

Yes. Vendors can submit documentation updates to support@primebiometry.com. We review submissions and update assessments if the data changes a sub-criterion score. Editorial conclusions are not adjusted on request.

How is the 20% compliance weight calculated?

Compliance Coverage is scored out of 20 points using five sub-criteria (GDPR, SOC 2, ISO 27001, CCPA, HIPAA) worth 4 points each. The final percentage score is then weighted at 20% of the overall vendor score.

Does PrimeBiometry accept payment for assessments?

No. Featured placements are paid, but they affect only positioning in category listings. Assessment scores and editorial copy are not available for purchase.

How do I report incorrect vendor information?

Email support@primebiometry.com with the vendor name, the incorrect field, and a source link. We investigate and update within 5 business days.

Why did weights change in 2026?

We updated methodology to v2.0 in June 2026 to add iBeta PAD certification as a Market Coverage sub-criterion, introduce a graduated Liveness detection scale (basic active through iBeta L2), expand the User Sentiment scale to differentiate vendors between 4.0 and 4.9 ratings, and reduce Pricing Transparency weight from 20% to 15% so that enterprise vendors who quote custom pricing on request are not penalized. See changelog at the bottom of this page.

Methodology Changelog

v2.0 2026-06-18
  • Compliance Coverage weight: 25% to 20%. Each sub-criterion 5 pts to 4 pts.
  • Market Coverage weight: 20% to 25%. Added iBeta PAD certification as a fifth sub-criterion.
  • Pricing Transparency weight: 20% to 15%. Removed "Minimum commitment" sub-criterion. Reduces penalty on enterprise vendors with custom pricing.
  • User Sentiment weight: 10% to 15%. Replaced 4-tier rating scale with a graduated 5-tier scale (4.7+ / 4.4 to 4.6 / 4.0 to 4.3 / 3.5 to 3.9 / below 3.5) so vendors with 4.0 and 4.8 ratings are no longer scored identically.
  • Liveness detection: replaced binary "documented" check with a graduated scale (basic active / passive / iBeta PAD L1 / iBeta PAD L2 or ISO/IEC 30107-3).
v1.0 2026-01-15

Initial publication. Five-criterion weighted scoring system (Compliance 25 / Integration 25 / Pricing 20 / Market Coverage 20 / User Sentiment 10).

About the Researcher

James Whitfield, Independent Researcher at PrimeBiometry

James Whitfield

Independent Researcher · PrimeBiometry

James Whitfield is an independent researcher and the creator of PrimeBiometry – a developer's take on evaluating KYC and identity verification vendors based on public documentation, API references, pricing pages, and aggregated review data. As a developer evaluating KYC APIs for a production project, he weighted Integration Depth and Market Coverage highest (25% each) – the criteria that surface most in technical due diligence before a procurement decision.

Full profile