Age verification.
Verify without storing.
Verifiable. Auditable. European.
API + SDK for European SaaS publishers under age-verification regulations (France ARCOM/SREN, EU age-verification blueprint). Complete public documentation. Cryptographic audit proof delivered with every verification.
§ The problem
What we solve
A French SaaS publisher subject to ARCOM / SREN needs an age verification path that is double-anonymous by construction, backed by a publicly verifiable compliance trail, and ready for the EUDI Wallet rollout — without re-integrating a verifier twice.
Problem
Existing verifiers give you a boolean yes/no and a compliance claim. When CNIL or ARCOM asks, you hand over a log — not a cryptographic proof. You depend on the verifier staying honest.
Approach
Tessaliq verifies the credential directly against the OID4VP 1.0 Final and HAIP standards, and returns a signed receipt. No personal data leaves the wallet. No trust in Tessaliq required: check the receipt against the published JWKS.
Proof
Four OIDF conformance plans passed, 24/24 modules applicable, zero warning — all publicly inspectable. A position paper submitted to ENISA. Circuits and SDK published under MIT license.
§ Flow
How it works
Four steps. No personal data stored. Every verification produces a receipt that is auditable by a third party, with no dependency on Tessaliq.
- 1
SaaS opens a session
Your backend calls
POST /v1/sessionswith the policy identifier (e.g.av_age_18_plus) and gets a session_id + verification URL back. Redirect the user to this URL. - 2
User presents a credential
The EUDI wallet signs the derived attribute (
age_over_18) directly — the birth date never leaves the wallet. Based on the ISO 18013-5 mdoc standard and theeu.europa.ec.av.1blueprint profile. - 3
Tessaliq verifies
ISO 18013-5 signature, IACA trust chain, nonce replay protection, key binding, validity window — all against the 4 OIDF-conformant plans. Zero-PII architecture: the verifier never receives a birth date.
- 4
Signed receipt issued
A signed JWT receipt (ES256) is returned with policy, session_id, assurance level, and proof hash. Your auditor can verify it independently via the public JWKS endpoint — no need to trust Tessaliq.
§ Differentiators
Three things that set Tessaliq apart
Publicly verifiable conformance
4 OpenID Foundation plans, 24/24 modules passed, zero warning. Every run is immutable and inspectable on demo.certification.openid.net. We are not aware of another verifier in the French age-verification market publishing an equivalent public OIDF conformance trail.
Auditable receipt, not opaque boolean
Every verification returns a signed JWT receipt (ES256) with
proof_hash, session_id, policy, assurance
level and timestamps — auditable by a third party via the published
JWKS, with no dependency on Tessaliq.
When CNIL or ARCOM asks for proof, you hold a cryptographic artefact,
not a request log.
Built for the French regulated market
Tessaliq targets the specific compliance needs of French SaaS publishers under ARCOM/SREN and ANJ regulation. Most competing verifiers are designed for mass-market international scope — Tessaliq prioritises the documentation, receipt trail and regulatory alignment that French auditors actually ask for.
§ Try it
Verify a receipt right now
Paste a Tessaliq receipt JWT in your browser and check its authenticity. The verification runs entirely client-side — only the public JWKS endpoint is fetched, the receipt contents never leave your machine.
§ Alignment
Standards and frameworks
Tessaliq implements and tracks the following standards and regulatory frameworks:
- OpenID4VP 1.0 Final — OpenID Foundation, 24/24 modules passed across 4 immutable public plans
- HAIP 1.0 Final — High Assurance Interoperability Profile, full coverage
- ISO 18013-5 + 18013-7 — mdoc credentials, Digital Credentials API
- SD-JWT-VC — IETF draft, disclosure + key binding
- EU Age Verification blueprint — profile
eu.europa.ec.av.1, the seven EU pilot Member States (FR, DK, GR, IT, ES, CY, IE) - ARCOM / SREN (France) — double anonymat by construction (§2024-20 referential)
- ENISA consultation — position paper submitted 2026-04-17
- eIDAS 2 / 2026/798 — remote onboarding reference standards ETSI TS 119 461
Ready to verify the first one?
If you publish content in France subject to ARCOM age verification and want to be EUDI-ready before the wallet rollout, let's talk.