Suirify: The Sovereign Identity and Compliance Bridge for Web3

Inspiration

Web3 has always had an identity problem. Every wallet is either a pseudonymous ghost - free, but locked out of anything requiring trust - or fully doxxed, trading away the privacy that made crypto worth building in the first place. There's a third, worse option too: handing custody of your identity to a centralized platform, which just recreates the Web2 silos crypto was supposed to replace.

We saw this trilemma play out most acutely in emerging markets, where regulatory frameworks are multiplying (in our home market alone, five separate regimes - securities, banking, data protection, tech policy, and telecom - all impose overlapping identity requirements) while the infrastructure to satisfy them compliantly and privately simply doesn't exist. Every fintech, exchange, and dApp was rebuilding the same brittle KYC pipeline from scratch, and users were re-uploading the same government ID to a dozen different insecure databases. We wanted to ask: what if you could verify who you are, once, and prove it everywhere - without ever revealing who you are?

What We Learned

Building Suirify meant sitting at the intersection of cryptography, regulation, and government systems integration, and each layer taught us something different.

On the compliance side, we learned that regulatory requirements are rarely as contradictory as they first appear - they can almost always be decomposed into a small set of boolean claims (is this person human? are they over 18? has their biometric been matched?) that satisfy multiple frameworks simultaneously. We formalized this as a "Policy as Code" model: a JSON registry mapping attestation fields to regulatory requirements, so that satisfying a new regulation is a data-entry problem, not a smart contract redeployment.

On the cryptography side, we learned to think in terms of commitments rather than data. The hardest design constraint was: how do you let a bank verify that an account belongs to a wallet's real-world owner without either party ever transmitting a name? The answer - a salted cryptographic commitment we call the Named Account Check - only became obvious after several failed attempts at building it as a lookup service instead of a proof.

On the infra side, we learned just how much Sui's object-centric model changes what's possible for identity. Attestations as first-class, user-owned Sui Objects, zkLogin removing seed phrases as an onboarding barrier, and sponsored transactions removing gas as a barrier, together, let us build an identity flow with almost no Web3-native friction for a mainstream, non-crypto-native user.

How We Built It

The system is architected around a strict separation between the off-chain trust computation and the on-chain proof of that computation:

Verification Portal - users connect via wallet or zkLogin (Google/social login), removing the seed phrase requirement entirely.
Isolated compute enclave - government ID and a live selfie are submitted here, never touching general-purpose infrastructure.
Biometric matching + liveness detection - an AI pipeline performs 3D liveness detection and matches the selfie against the government record inside the enclave.
Ephemeral processing - all personally identifiable information is purged from memory the instant a verification decision is reached. It is never persisted, on-chain or off.
Minting - a Suirify_Attestation object is minted directly to the user's wallet, containing only boolean claims and cryptographic commitments (e.g. is_human_verified, is_over_18, name_hash) - never raw personal data.

We defined three verification levels (VL1-VL3), each adding a further layer of assurance - from basic liveness and uniqueness checks suitable for sybil-resistant airdrops, up to full biometric matching suitable for undercollateralized institutional lending - so that the depth of verification a dApp requests can scale with the risk of what it's granting access to.

For the smart contract layer, we built and deployed to Sui Testnet, published an SDK to npm so integrating dApps could request a verification level and receive a boolean-claims object back with minimal code, and built a P2P fiat off-ramp simulator to validate the Named Account Check flow end-to-end.

Challenges We Faced

Designing privacy that survives compliance audits. It's easy to build something private. It's much harder to build something private that regulators will actually accept as sufficient evidence of compliance. We had to design the attestation schema iteratively against real regulatory text, mapping each field back to a specific clause in a specific framework, to make sure "zero PII on-chain" wasn't just a slogan but something we could defend line by line.

The government-integration bottleneck. Sovereign ID databases are, by design, not built for external API access, and delays or access limitations here are the single largest external risk to the roadmap. We mitigated this by architecting Phase 1 around a mocked verifier node, so that core protocol logic, the attestation model, and the SDK could all be built, tested, and proven out independently of when formal data-partner access is finalized - de-risking the timeline instead of blocking on it.

Key management for a single point of catastrophic failure. A compromised VerifierAdminCap key would be an existential risk - it's the one component that, if compromised, could undermine trust in every attestation ever issued. We addressed this with HSM/KMS-backed storage, on-chain rate limiting, and real-time anomaly detection with automatic shutdown, rather than treating key security as an afterthought bolted on post-launch.

Cold start. Identity infrastructure is a two-sided market problem: no users without dApps that accept the attestation, no dApps without users who already have one. We addressed this with a free entry-level tier as the primary acquisition engine, paired with early ecosystem partnerships, so the flywheel could start turning from day one rather than waiting for critical mass to appear on its own.

Suirify: one attestation, many frameworks, zero PII on-chain.