Sector · ML credentialing
Verifying who someone is, and what they're qualified to do.
Credentialing is the bottleneck in every regulated workforce. We apply machine learning to the document-heavy, rules-heavy work of verifying registrations, qualifications, training and background checks — with a human in the loop where it matters and an audit trail behind every outcome.
How verification works
From upload to verified credential, with the reasoning attached.
Document forensics
Every upload passes a battery of analysers before anyone reads it: error-level analysis, template matching, metadata inspection, font consistency, copy-move detection, cross-reference against known fraud patterns, and an LLM consistency check. Each produces a pass, flag or fail with a score, the regions it examined and the model version that ran.
Verification at the source
Extracted fields are checked against the issuing body through the best available pathway: a direct register API, browser automation against a regulator's public lookup, structured outreach to the issuer, or forensics alone where no register exists. Pathways are ranked by success rate, latency and cost, with automatic fallback.
Human in the loop, by design
Anything flagged, low-confidence, mismatched against a register or from an unknown issuer is routed to a prioritised review queue with an SLA. Rejection is only ever reachable through a human decision — enforced structurally, not by policy — and every outcome can be appealed.
Fraud intelligence that compounds
Confirmed fraud is captured as reusable patterns — template fingerprints, diploma mills, proxy testing, serial ranges, metadata signatures — with severity and hit counts. Unknown issuers open an investigation rather than a rejection. The system gets harder to fool with every case it sees.
What we verify
Built first for health, care and regulated-workforce pilots, and extensible to any issuer with a register, a lookup tool, or a contact address.
- Professional registrations — NMC, HCPC, GMC, GPhC, Social Work England PINs
- Degrees and higher education awards
- Exam results — GCSE, A-level, BTEC, NVQ, SQA, IELTS, TOEFL
- Training certificates — safeguarding, first aid, manual handling, food hygiene, fire safety, SIA, CSCS, CPD
- DBS, disclosure and PVG checks, basic to enhanced
- Right-to-work — Home Office share codes and passport checks with face match
- References and employer skill attestations
Architecture principles
Decisions you can defend to a regulator, an insurer, or the worker.
One agent per issuer, per credential
Registers are heterogeneous, so validation is bespoke to each combination of issuer, credential type and sub-type — its own agent, model and threshold. Scores from different agents are never pooled, and every threshold change is versioned so any historical decision can be reproduced.
Verified once, presented anywhere
Outcomes are issued as W3C Verifiable Credentials 2.0, signed by the issuer's did:web and held against the worker's own did:key. Revocation and suspension use bitstring status lists, so a third-party verifier can check status without an account on our platform.
The worker controls disclosure
Sharing grants name the exact credentials shared, with whom, for how many accesses and until when. Every presentation is logged as valid, expired, revoked or tampered. Nothing leaves a worker's wallet without their explicit consent.
Built for the regulator's questions
Protected characteristics are never decision features. Documents carry a retention clock and a hash. Consent is recorded by type. Every action — by tenant, worker, reviewer, agent or system — lands in a single audit log. Designed against GDPR and the EU AI Act, not retrofitted to them.
Skills, not just certificates
A coaching model infers named skills from conversation, maps them to ESCO and SOC taxonomy codes, keeps the verbatim evidence, and only mints a credential once the worker confirms it. Gap analysis then points to the next credential worth earning, scored against live labour-market data by region.
Headless and licensable
Multi-tenant from day one with scoped API keys, single-worker subject tokens, HMAC-signed webhooks with at-least-once delivery and idempotency on every mutating call. The first platform on it uses exactly the same API a third-party licensee would.
A wallet the worker owns
Verified credentials travel with the worker — across employers, agencies and sectors — rather than disappearing when a contract ends. The portability layer is a native skills wallet, built on the same Verifiable Credentials standard.
- Native iOS wallet with Face ID or Touch ID lock and on-device encrypted storage
- Photograph a paper certificate and submit it for verification from the phone
- Present a credential as a QR code or share the signed document — worker-initiated only
- SHA-256 fingerprint and cryptographic proof details visible on every credential
- Live status — verified, expiring, expired, revoked — computed on device
- Enrolment by single-use code: the device speaks for one worker, never for a platform