Stop holding data
you shouldn’t have to own
Every year businesses spend billions complying with regulations built around one assumption — that you have to store customer PII. Avallis doesn't eliminate your compliance obligations. It eliminates the expensive, friction-heavy infrastructure required to meet them. Verify without touching. Trust without storing.
The hidden cost of holding customer data
Regulatory compliance is one of the fastest-growing cost centers for any business that touches personal data.
$5.5M avg/year
Legal & Compliance Teams
Every regulation requires dedicated legal review, privacy counsel, and ongoing compliance monitoring. Average enterprise compliance cost: $5.5M/year.
$2.1M avg/year
Security Infrastructure
Encryption systems, key management, HSMs, SOC 2 audits, penetration testing, and 24/7 security monitoring for data you'd rather not hold.
$4.88M avg breach
Breach Liability
Average cost of a data breach in 2024 was $4.88M — not counting reputational damage, customer churn, or regulatory fines layered on top.
3–8 FTEs typical
Data Governance Teams
DPOs, privacy engineers, consent management platforms, data mapping, DSAR fulfillment — entire departments built around data you don't need to own.
$4.88M
Average cost of a data breach
IBM Cost of Data Breach Report 2024
83%
Of breaches involve internal actors or human error
Verizon DBIR 2024
277 days
Average time to identify and contain a breach
IBM Security 2024
Federal & global regulations you’re subject to
Every regulation below applies to businesses that store or process customer PII. Avallis addresses each one directly.
GDPREuropean Union
Up to €20M or 4% of global annual revenue
European Union
Up to €20M or 4% of global annual revenue
Key Requirements
- Explicit, documented user consent before collecting PII
- Right to access, correct, and erase personal data
- Data portability — users can take their data elsewhere
- Breach notification within 72 hours
- Privacy by design in all systems
How Avallis Addresses This
Every data access is consent-anchored on blockchain. Users can revoke anytime. No raw PII touches your servers via tokenization.
CCPA / CPRACalifornia, USA
Up to $7,500 per intentional violation
California, USA
Up to $7,500 per intentional violation
Key Requirements
- Disclose what data you collect and why
- Honor opt-out of data sale requests
- Delete user data on request within 45 days
- Non-discrimination for exercising privacy rights
- Annual data risk assessments (CPRA)
How Avallis Addresses This
Users control their own vault. Revocation instantly invalidates all access — cryptographically enforced, not just a policy promise.
GLBAUSA — Financial Institutions
Up to $100,000 per violation + criminal liability
USA — Financial Institutions
Up to $100,000 per violation + criminal liability
Key Requirements
- Safeguard consumer financial information
- Provide privacy notices to customers
- Give customers opt-out rights for data sharing
- Implement written information security plan
- Vendor oversight for third-party data handlers
How Avallis Addresses This
Financial data is encrypted client-side. Your institution stores tokens, not raw account numbers or credit scores.
HIPAAUSA — Healthcare
Up to $1.9M per violation category annually
USA — Healthcare
Up to $1.9M per violation category annually
Key Requirements
- Protect all Protected Health Information (PHI)
- Minimum necessary standard for data access
- Business Associate Agreements with all vendors
- Audit controls and access logs
- Patient right to access their own records
How Avallis Addresses This
Health data is vault-encrypted and user-controlled. Via Data Tokenization, raw PHI never enters your database — significantly reducing your BAA exposure and compliance surface area. Note: Avallis does not replace your HIPAA compliance obligations; it reduces the scope of what you must protect.
BSA / AMLUSA — Financial Institutions
Up to $1M per day + criminal prosecution
USA — Financial Institutions
Up to $1M per day + criminal prosecution
Key Requirements
- Customer Due Diligence (CDD) at onboarding
- Ongoing transaction monitoring
- Suspicious Activity Reports (SARs)
- Know Your Customer (KYC) identity verification
- Beneficial ownership identification
How Avallis Addresses This
Avallis Portable Identity plugs into your existing KYC/CDD workflow — when a customer approves a data request, your KYC platform automatically receives their verified vault data without document uploads or manual data entry. Your compliance team still owns the verification decision, ongoing monitoring, and regulatory reporting. The expensive, slow document-collection layer is what gets replaced.
PCI-DSSGlobal — Card Processors
$5,000–$100,000/month + card processing suspension
Global — Card Processors
$5,000–$100,000/month + card processing suspension
Key Requirements
- Encrypt cardholder data at rest and in transit
- Restrict access to cardholder data by need-to-know
- Maintain access logs and audit trails
- Vulnerability management and penetration testing
- Network segmentation for card data environments
How Avallis Addresses This
Tokenization replaces raw card data with secure tokens. Your infrastructure never touches the original PAN — shrinking your PCI scope dramatically.
Important: What Avallis does — and does not — replace
Avallis reduces the cost and friction of KYC/CDD data collection. It does not eliminate your regulatory obligations.
What Avallis replaces
What Avallis does NOT replace
Avallis functions as a third-party identity data provider within your existing KYC workflow — similar to other identity verification services your compliance team may already use. Your compliance team still owns the verification decision, ongoing monitoring, and regulatory reporting obligations. Always consult your legal and compliance counsel before integrating any identity data provider.
Use cases by industry
How leading sectors use Avallis Portable Identity and Data Tokenization to reduce regulatory burden while improving customer experience.
Banking & Lending
Mortgage Origination
Pull verified Identity + Financial data from applicant's vault for underwriting. Consent-anchored — no manual document collection.
Account Opening KYC
Customer approves a Portable Identity data request in one tap. Your KYC platform receives their verified Identity + Financial data as structured JSON — no document uploads, no manual data entry. Your compliance team reviews a pre-populated, blockchain-verified profile and makes the determination.
Credit Risk Assessment
Access income, employment, and credit score data directly from the user's encrypted Financial vault via consent.
Loan Application
Customer clicks "Apply with Avallis" on your site. They approve sharing identity + financial data from their vault in one tap. Your system receives encrypted fields. If they close the account later, one click sends a CCPA/GDPR deletion request — you confirm, they get written proof.
Insurance
Policy Underwriting
Access health, travel, and identity data for risk assessment — user-consented, auditable, no HIPAA BAA exposure.
Claims Processing
Verify claimant identity and relevant data (medical, contact) in real-time with full audit trail.
Fraud Prevention
Cross-reference tokenized identity against your records — the blockchain anchor proves data hasn't been tampered with.
Fintech & Payments
Payment Tokenization
Replace raw account numbers with Avallis tokens. Your system stores tokens — raw PAN never enters your PCI scope.
User Onboarding
Accelerate your KYC data collection step — users approve from their vault instead of uploading documents. Your compliance team still performs the verification decision and ongoing monitoring.
AML / Transaction Screening
Verified identity data enables stronger AML screening without storing sensitive customer files.
Healthcare
Patient Intake
Pull insurance, contact, and health data from patient vaults — consent-gated, reducing paper intake friction and limiting the PHI your systems must store. Your HIPAA compliance obligations remain in full.
Insurance Verification
Access Member ID, Group Number, and plan details directly — no phone trees, no manual verification.
Prescription Processing
Rx BIN and PCN accessible via consent from patient vault — streamlining pharmacy workflows.
Built-in compliance
CCPA and GDPR infrastructure — included
Most companies build deletion workflows, consent records, and audit trails separately — or don’t build them at all. Avallis makes them a byproduct of using the platform.
Without Avallis
Manual deletion handling
Emails to legal. Spreadsheets. No deadline tracking. No confirmation.
Ad-hoc consent records
ToS buried in onboarding. No per-request audit trail. Regulators ask — you guess.
Raw PII liability
Every breach exposes customer data you hold. GLBA/CCPA remediation costs $200K–$2M.
Siloed compliance systems
Consent management, deletion workflows, and audit tools from different vendors — never in sync.
With Avallis
Automated deletion workflow
User clicks End Relationship. You get a webhook + email. Confirm in the portal. They get written proof. 30-day CCPA/GDPR clock tracked automatically.
Blockchain-anchored consent
Every data request consent recorded on a public blockchain. Independently verifiable. Per-request, per-purpose, per-category — irrefutable if audited.
Zero-PII architecture
Vault Verify API returns booleans — not data. Data Request API delivers encrypted fields only you can decrypt. Nothing to breach on your side.
One unified system
Consent records, deletion confirmations, and audit trail in one platform. CCPA, GLBA, GDPR by architecture — not by retrofit.
New — Data Request API
Request structured data.
Receive encrypted fields.
Liability ends at confirmation.
Your system sends a data request to a user’s email. They approve on their own time. Their vault data is ECDH-encrypted to your registered public key — Avallis servers can’t read it, only your server can. When they invoke their right to delete, you get a 30-day deadline, you confirm deletion, they get written proof. The compliance record is automatic.
You send data request
Email to applicant with your purpose
User approves in vault
Reviews categories, approves in one tap
Encrypted payload delivered
Webhook to your server — only you decrypt
Deletion request — confirm
30-day clock · written confirmation · audit trail
Approved-partner network — not an open API
Only businesses that have signed a partner agreement and been approved by Avallis can create data requests or appear in the user connect flow. When your users see your company name in an approval screen, they know you’re a verified partner — not an unknown third party. That trust signal is built into the architecture, not bolted on.
Portable Identity — plug into your existing KYC/CDD workflow
Avallis Portable Identity is not a replacement for your KYC process — it replaces the most expensive part of it: document collection. Your compliance team still owns the verification decision, risk assessment, and regulatory obligations. Avallis delivers pre-verified, consent-anchored customer data directly into your existing KYC platform, automatically.
What Portable Identity replaces — and what it does not
Portable Identity replaces the document collection step of your KYC workflow — the passport uploads, utility bills, manual data entry, and 1–3 day review queues. It does not replace your KYC/CDD decision-making, ongoing monitoring, adverse media screening, SAR obligations, or risk-rating process. Your compliance team receives a pre-populated profile with a blockchain-anchored consent record. They still make the determination. Avallis functions as a third-party identity data provider within your existing workflow — similar to other identity data services your compliance stack may already use. Always consult your legal and compliance counsel before integration.
Business initiates KYC
Your system calls the Avallis KYC/CDD API with the customer identifier and required data categories.
Customer approves once
Customer receives a notification — SMS + dashboard — showing your company name, the data categories requested, and the stated purpose. One tap approves the share.
Portable Identity delivers to your KYC platform
Verified vault data — Identity, Financial, Contact — is end-to-end encrypted to your server and delivered via webhook. Your KYC platform receives a structured JSON profile, pre-populated and ready for compliance review.
Compliance team reviews
Your team receives a pre-populated, blockchain-verified customer profile. Decision, monitoring, and SAR obligations remain with your institution.
Traditional KYC workflow
Avallis Portable Identity + KYC/CDD
The key differentiator
Other identity providers require you to build or buy KYC tooling separately. Avallis Portable Identity is designed to feed your existing KYC/CDD system — not replace it. Verified customer data arrives pre-structured and consent-anchored, ready for your compliance team’s review. Your workflow stays the same. The document-collection bottleneck disappears.
Privacy-Preserving Identity Verification API
Coming SoonConfirm user attributes via API with a boolean response — no PII transmitted, ever. Ask whether a user meets an age threshold, income band, or address match. Avallis decrypts in volatile server memory, evaluates, discards. Your system receives only yes or no. SOC 2 Type II certification in progress.
Pre-verified customer data — out of the box
When a customer's vault data has already been verified by Avallis IVE, your KYC/CDD request returns verified results instantly — no additional API calls, no document collection, no manual review queue.
Customer Flow
Vault auto-verification
Customer saves address to vault
Third-party address validation runs in background
Customer saves phone number
Third-party carrier intelligence detects VoIP and fraud risk
Customer saves email
Deliverability, MX, disposable check runs silently
VERIFIED badge appears on each field
Score, provider, timestamp stored in vault
Business Flow
KYC/CDD with IVE cache
Business calls POST /api/ive/verify
Includes vault wallet address + consent reference
IVE checks for cached vault verifications
If address verified <30 days ago → cache hit, skip API
Fresh checks run only on unverified fields
Reduces API cost + latency significantly
Returns PASS / REVIEW / FAIL + trust score
Includes verification timestamp and provenance
The reusability advantage
A customer verified once by Bank A doesn't need to re-verify for Bank B. Their Avallis vault carries a timestamped verification certificate issued by an independent third-party engine. Your institution receives that certificate — reducing onboarding from days to seconds, and cutting verification API costs for every subsequent request.
Verify without seeing
The Vault Verify API lets your systems check facts about a customer's identity — age, income, credit score, SSN match — without the raw data ever leaving Avallis infrastructure. You get a yes or no. Nothing else.
Old way
Raw data flows to you
Customer submits SSN, DOB, income documents. Your infrastructure stores, processes, and transmits PII — creating liability, compliance scope, and breach risk at every step.
Avallis way
Only the answer flows to you
Customer grants consent once. Your system holds a token. When you need verification, Avallis processes the check server-side and returns true or false. No PII ever touches your infrastructure.
The result
Compliance scope eliminated
You never store PII → no GLBA safeguards for that data. No SSNs → no data breach liability for that field. No income docs → no SOC 2 scope for that workflow. The risk stays with Avallis by design.
API Request
POST /api/vault-verify
x-api-key: avl_live_...
{
"consentToken": "f47ac10b-...",
"checks": [
{ "check": "age_over_18" },
{ "check": "ssn_last4_match",
"params": { "last4": "1234" } },
{ "check": "income_above",
"params": { "threshold": 50000 } }
]
}API Response — no PII returned
{
"verified": true,
"category": "identity",
"results": [
{ "check": "age_over_18", "verified": true },
{ "check": "ssn_last4_match", "verified": true },
{ "check": "income_above", "verified": true }
],
"checkedAt": "2025-03-17T10:42:11Z"
}How integration works
Get provisioned
Your business account is created in the Avallis portal by our team. You receive API credentials.
Customer grants consent
Customer opens their Avallis dashboard and grants your business access to a specific data category. A consent token is sent to your system.
Call the verify API
POST to /api/vault-verify with your API key, consent token, and the check you need. No PII required.
Act on the result
Receive true/false and proceed with your workflow. Every check is logged in the customer's audit trail for transparency.
Sentinel Intelligence
An AI-driven rules engine that protects every access point — consumer logins, business data requests, and AI agent calls. Every event is analyzed in real time against multiple risk signals and an AI contextual layer, then enforced: suspicious access is blocked, not just flagged.
Real-time signal capture
Every vault event — consumer login, consent grant, data share, approval, agent call — is enriched with location, behavioral, and compliance signals in real time.
Rules engine + AI scoring
Multiple deterministic risk signals run first — covering behavioral anomalies, location patterns, velocity, and sanctions compliance. An AI layer then assesses whether the combination reflects a legitimate use case or a genuine threat.
Tiered automated response
Low risk: logged and monitored. Medium risk: soft flag returned to your system. High risk: access blocked instantly, vault owner notified via SMS, session invalidated.
What Sentinel detects
Rule
What triggers it
Severity
Account Takeover
Access patterns inconsistent with prior session history on high-value actions
Impossible Location Jump
Location change that is physically impossible for a real user
VPN / Proxy Access
Known VPN exit node, Tor, or datacenter proxy IP attempting to mask true origin
Rapid Consent Grants
Unusually high consent approval velocity — consistent with automated data exfiltration
Grant/Revoke Pattern
Rapid consent grant then revoke — a pattern consistent with probing data access
Category Escalation
Unexpected access to higher-sensitivity vault categories — lateral escalation pattern
Unusual Access Hours
Access at atypical hours with no prior history in that window — behavioral anomaly
Sanctions Country Match
Request originates from a sanctioned jurisdiction — automatic block regardless of other signals
Sanctions Entity Match
Recipient business name matches an entry on government sanctions lists
AI Contextual Analysis
AI layer evaluates the full signal combination — distinguishes legitimate patterns from genuine threats
Enterprise: Risk score in every webhook event
When a consumer approves a Data Request, the webhook includes a real-time Sentinel risk score. Growth and Scale receive score, tier, and blocked flag — enough to gate your downstream workflow. Enterprise receives the full findings breakdown, OFAC match detail, AI reasoning, and tamper alerts — audit-ready for compliance teams.
1 — Webhook event (arrives at your endpoint)
{
"event": "data_request.approved",
"requestId": "req_abc123",
"subject": "customer@example.com",
"approvedAt": "2026-07-03T12:00:00Z",
"categories": ["identity", "contact"],
"encryptedPayload": { "iv": "...", "ciphertext": "...", "tag": "..." },
"ownerEphemeralPublicKey": { ... },
"risk": { // Enterprise plan only
"score": 12,
"tier": "low", // low | medium | high
"blocked": false,
"findings": []
}
}2 — After decryption of encryptedPayload
{
"identity": {
"firstName": "John",
"lastName": "Smith",
"dob": "1990-04-15",
"address": "123 Main St, Los Angeles CA 90001"
},
"contact": {
"email": "john.smith@example.com",
"phone": "+1 (555) 234-5678"
}
}3 — Gate your workflow on risk.tier
// risk and identity arrive in the same webhook event
// risk is in the event body; identity requires ECDH decryption
if (event.risk?.tier === 'high' || event.risk?.blocked) {
return flagForManualReview(event.requestId)
}
if (event.risk?.tier === 'medium') {
return requireAdditionalVerification(event.requestId)
}
const identity = await decryptPayload(event.encryptedPayload, privateKey)
await processKYC(identity) // low risk — auto-approveVault owner: Sentinel dashboard
Individual users see their real-time Security Score (0–100) in their Sentinel Intelligence dashboard. High-risk events — including suspicious logins and compromised MetaMask wallet patterns — trigger an automatic block and immediate SMS alert. Sentinel protects consumers at every access point: login, consent approval, and data sharing.
How Avallis works for your business
Two integration models — pick the one that fits your workflow.
Portable Identity — for KYC/CDD, Lending & Onboarding
You send a data request
Your system calls the Avallis API specifying which data categories you need (Identity, Financial, etc.) and the user's identifier.
User is notified
The user receives an SMS + dashboard notification: "Chase Bank is requesting your Identity data for mortgage application."
User approves
One tap on the dashboard. Cryptographic key exchange happens in the browser — zero-knowledge to Avallis.
Structured data delivered — your team makes the KYC determination
Verified JSON — name, DOB, address, income — delivered to your endpoint via webhook, end-to-end encrypted. Your compliance team reviews the pre-populated profile and makes the final KYC determination. Ongoing monitoring, adverse media screening, and SAR obligations remain with your institution.
Data Tokenization
You send raw PII
Your system POSTs a JSON payload containing PII — SSN, account number, medical ID, passport, etc. — to the Avallis Tokenization API.
Avallis encrypts + vaults
We encrypt the data, anchor a cryptographic fingerprint on the blockchain, and associate it with the user's vault.
You receive a secure token
A UUID token is returned. Store only the token — raw PII is gone from your system. Your PCI/HIPAA/GDPR scope shrinks immediately.
Consent-gated retrieval
When you need the data back, the user approves via the Avallis dashboard. The original PII is returned only after explicit consent — fully audited.
Verified once. Trusted everywhere.
The compounding advantage of the Avallis network: every institution that integrates makes the credential more valuable, and every verified user reduces onboarding cost across the entire ecosystem.
Re-verification time
A user verified by Bank A onboards at Bank B instantly. Their Avallis vault carries a timestamped, third-party-issued verification certificate. Your institution inherits the verification — not the liability.
Reduction in KYC cost
When a customer's vault data is already IVE-verified, your KYC/CDD request hits a cache. Third-party API calls are skipped. You pay only for genuinely new verifications — not repetitive checks on the same user.
PII stored on your servers
The Vault Verify API returns true or false. Your system never receives a name, SSN, DOB, or income figure. Your compliance surface area shrinks to the API call — not the data it answers questions about.
The Avallis flywheel
User verifies on Avallis
Saves data, runs IVE, gets VERIFIED badges on their vault fields.
Business integrates API
Calls vault-verify with consent token. Gets yes/no results. Stores zero PII.
Credential becomes portable
The same vault serves the next institution without re-verification.
Network grows more valuable
More integrations → more value for users. More users → more value for businesses.
Show verified users on your platform
Users who verify their Avallis vault earn a cryptographically-backed Verified Badge. Embed it on your platform to show that a user has been independently verified — without storing or processing any of their identity data yourself.
Embed in seconds
One script tag. Renders the badge in real time, auto-verifies on load.
API verification
Call POST /api/badge/verify to check a badge programmatically — no PII exchanged.
Tamper-evident
Badge status is cryptographically signed and blockchain-anchored. Cannot be faked.
User controls it
The user can revoke their badge at any time from their Avallis dashboard.
Embed on your platform
<!-- One script tag — renders inline -->
<script
src="https://badge.avallis.io/v1/embed.js"
data-user-id="user_abc123"
data-show-details="true"
></script>
<!-- Or verify via API -->
POST /api/badge/verify
x-api-key: avl_live_your_key
{ "userId": "user_abc123" }
→ {
"verified": true,
"categories": ["identity", "contact"],
"issuedAt": "2026-06-01T00:00:00Z",
"blockchain": "0x978E..."
}The identity and consent layer
your agents are missing
Agentic AI workflows act on behalf of users — pulling personal data, making decisions, triggering actions. Today there is no clean answer to: who authorized this, what data was accessed, and can you prove it. Avallis is purpose-built for exactly that.
Without Avallis
Agent accesses PII directly
Data enters model context — breach vector
No per-action consent
GDPR/CCPA exposure on every API call
Multi-agent handoffs re-expose PII
Data leakage across trust boundaries
No audit trail
"What did the agent see?" has no answer
With Avallis
Agent gets a scoped consent token
User grants access to specific categories, max calls, and duration
Zero-PII verification
Agent calls vault-verify — gets pass/fail, never raw data
Every call logged
Immutable audit trail: which agent, which check, which result
User revokes anytime
Dashboard shows all active agent grants — one click to revoke
How it works — 3 steps
User grants agent consent
User opens their Avallis dashboard and creates an Agent Consent Grant — specifying which data categories the agent can check, for how long, and a max call limit.
Business passes consent token to agent
Your system receives the consentToken from the approved Data Request. Pass it to your AI agent — the agent uses it exactly as any API client would. The consumer does nothing differently.
Agent calls /api/agent/verify
The agent calls POST /api/agent/verify with the consent token and an agentName label. Avallis runs the checks and returns pass/fail. The agentName is logged in every audit record so you can trace exactly which agent accessed what.
Agent calls vault-verify (no PII in context)
// consentToken comes from an approved Data Request — standard flow
// Agent calls /api/agent/verify (same as vault-verify + agentName logging)
const result = await fetch('/api/agent/verify', {
method: 'POST',
headers: {
'x-api-key': process.env.AVALLIS_API_KEY,
'Content-Type': 'application/json',
},
body: JSON.stringify({
consentToken: consentToken, // from approved Data Request
category: 'identity',
checks: ['age_over_18', 'name_match'],
agentName: 'LoanBot v2', // logged in audit trail
}),
}).then(r => r.json())
// Agent gets pass/fail — never raw PII
if (result.verified) proceed()
else requestAdditionalContext()Every access is audited
// Immutable audit record (Avallis internal)
{
"event": "agent.vault_verify",
"agentToken": "agt_abc123",
"agentName": "LoanBot v2",
"businessId": "your_business_id",
"checks": ["age_over_18", "name_match"],
"result": "pass",
"callCount": 3,
"maxCalls": 100,
"revokedAt": null,
"timestamp": "2026-07-04T12:00:00Z"
}Loan decisioning agents
Agent verifies income, employment, and identity against the applicant's vault. Underwriting runs without PII ever entering the model — compliant by architecture.
Patient intake automation
Pull insurance, contact, and health data from patient vaults — consent-gated, HIPAA-scoped. PHI never enters the agent context window unless explicitly authorized.
Multi-agent orchestration
Orchestrator agents delegate to specialists — each holding only a scoped consent token for their task. Consent enforced at the vault — not by hoping the orchestrator passes the right fields.
Build on the consent-first
identity authority
Integrate Avallis into your stack and inherit a verified credential network instead of building one. Most API integrations complete in under a week.
No commitment required · Typical integration: 3–5 days · White-label available