Klaw API — verification as a service
Verify anyone.Store nothing.
One POST returns a 0–100 score, a Pass / Review / Fail decision, a signed token, and a report of where that identity is already exposed on the surface web and the dark web. The applicant’s data is destroyed before the response is written — so it never becomes yours to lose.
POST /v1/verifications201{
"decision": "pass",
"trust_score": 87,
"risk_score": 13,
"grade": "B — Low risk",
"score_governs": true,
"confidence": "high",
"exposure": {
"surface_web": 3,
"dark_web": 1,
"removal_routes": 2
},
"token": "eyJhbGciOiJFZERTQSIsImtpZCI6…",
"retained": null
}retained: null is not a promise. It is the response field.
What you get back
Everything a decision needs. Nothing a breach could want.
A single 0–100 score
trust_score for the screen, risk_score for your policy engine. They always sum to 100, so nobody has to remember which direction is good.
A decision, not a data dump
Pass, Review or Fail against your thresholds — plus triggered_rules naming exactly which rule fired, so you can explain a decline a year later.
Where the identity is exposed
Surface web and dark web, with the source, the date and a removal route where one exists. Useful to you, and useful to the applicant.
A signed result token
Ed25519 JWS with a public JWKS. Your downstream services verify the outcome offline, without calling us and without seeing the applicant.
Proof of what was kept
GET /retention returns the record for any verification. The honest answer is a list of digests and a decision — never a value you sent.
A sandbox that costs nobody
Fixture addresses on klaw.test drive every decision path on demand. Test keys are never metered, so your CI cannot run up a bill.
The pipeline
Three steps. The third is the product.
You send
An applicant’s details arrive over TLS, on your server-side call or through a hosted page on our origin — where the data never touches your DOM, your logs or your error tracker.
We screen
Ten checks run against breach corpora, sanctions and denylists, surface-web exposure, and device and velocity signals. Range queries mean the corpus never learns who we asked about.
It is destroyed
The buffers are zeroed in a finally block before the response is written. What survives is a decision, reason codes and irreversible digests. There is no copy to subpoena.
Three ways in
Take the data yourself, or never touch it at all.
The same pipeline, the same score, three different answers to the question of who holds the applicant’s details for the four seconds it takes to screen them.
Server to server
You collect the details in your own form and POST them. Simplest to build, and you hold the data for the length of one request.
- One POST, one JSON response
- Idempotency keys and request signing
- Your form, your validation
Klaw-hosted intake
The applicant types into a page served on our origin. Their data never enters your DOM, your network tab, your error tracker or your logs.
- Strongest promise you can make them
- Frame customisation with live preview
- You get the decision, never the input
Returning applicants
Someone verified elsewhere can autofill with a one-tap challenge. No re-typing, and it bills at the lower reuse rate because no corpus is queried.
- Device-bound envelope encryption
- Applicant can inspect or revoke
- Cheaper than a fresh screening
Pricing
A platform fee, plus a micro-transaction per verification.
You are paying for the pipeline, not for us holding your applicants’ data. Reused attestations and monitoring re-runs bill lower, because they cost us less to serve.
Pay As You Go
No commitment
$0/mo
79¢ per verification
0 included
- Direct API
- Hosted popup
- Webhooks
- Exposure report
Starter
Small teams
$299/mo
45¢ per verification
500 included
- Everything in PAYG
- Lower unit rate
- Priority support
Growth
PopularMost businesses
$999/mo
32¢ per verification
2,500 included
- Klaw Link autofill
- Custom policy
- Lower unit rate
Scale
High volume
$2,499/mo
22¢ per verification
10,000 included
- Request signing
- Audit export
- 99.95% SLA
Sandbox costs neither of us anything.
Test keys run the real pipeline against fixture addresses on klaw.test. They are metered for visibility and billed at zero — so a runaway loop in your CI is an embarrassment, not an invoice. Forever Free is not on this list; it is granted, never sold.
Build it yourself, or don’t hold it at all
You could build this. Then you would own the data.
Every part of this is buildable — corpus queries, a scoring model, a policy engine. What you cannot build away is the copy of the applicant’s identity sitting in your database afterwards, and the breach notification you write the day it leaks.
Breach and dark-web corpora
Sanctions and denylist screening
A defensible 0–100 score
Zero applicant data at rest
Nothing to disclose in a breach
Nothing to hand over on subpoena
Signed, offline-verifiable results
Someone else keeps the corpora current
Klaw API
Build it
FAQ
The questions engineers actually ask.
Two ways, neither of which asks you to trust us. GET /v1/verifications/:id/retention returns the record for any run — the honest answer is a decision, reason codes and irreversible digests. And the test suite searches every stored record, API response, webhook payload and signed token for the exact values submitted; if any of them appear, the build fails.
The check is excluded from scoring rather than scored as zero. A dead upstream never silently penalises an applicant — it lowers coverage, and the confidence field reports it. Set minimum_coverage in your policy and thin results route to review automatically.
No. Subject references are HMACs of a process pepper plus a per-tenant salt, so the same applicant produces a different reference for every business. There is no join key, by construction.
Usually, but not always — and the response says which. A sanctions hard stop carries no weight in the number, so a blocked applicant can genuinely measure at trust_score 100. In that case score_governs is false and blocked_by names the rule, so nothing ever renders "approve" beside a decline.
Nothing, for either of us. Test keys run the real pipeline against fixture addresses on klaw.test and are billed at zero. One account carries both key types, so your sandbox and production traffic live side by side.
Create an API account. Keys in two minutes.
Start on test keys, which cost neither of us anything. Add a card when you are ready to run live traffic — there is no platform fee on Pay As You Go.
help@klawusa.org