OCR Studio has received an independent security certificate from SC2labs confirming that its ID scanning tools process data entirely on-device.
OCR Studio, a developer of client-side identity document scanning technology, has received an independent security certificate confirming that its solutions perform ID recognition entirely offline, without transmitting personal data outside the user’s device. The certificate was issued by cybersecurity auditor SC2labs following a dedicated security assessment. The evaluation covered OCR Studio’s software development kits (SDKs) for Android and iOS applications, as well as its WebAssembly-based technology for ID scanning in web browsers.
How the assessment was carried out
The auditors tested OCR Studio’s solutions on physical Android and iPhone devices and in virtualised containers. They analysed network traffic while running the SDKs with a range of document images, corrupted or tampered files, and random binary data. Both automated and manual checks confirmed that ID scanning neither requires nor uses network communication, and that sensitive data and document images are not transmitted beyond the device.
The assessment found no security vulnerabilities in the tested SDKs and no issues affecting confidentiality, integrity, availability, authentication, authorisation, or accountability. The auditors also confirmed that the expected security controls were in place across mobile and web scenarios, concluding that the solutions demonstrate a strong security posture. The review followed standards including OWASP ASVS, OWASP MASVS, and OSSTMM, and was carried out by SC2labs specialists with experience in PCI DSS, the PCI Software Security Framework, and penetration testing.
Demand for local identity processing
Konstantin Bulatov, CTO of OCR Studio, stated that, as concerns about personal data breaches grow, businesses are increasingly looking for fully local alternatives to cloud-based ID scanning. According to Bulatov, government agencies, banks, fintechs, telecom providers, and other organisations that want to keep identity data under their own control should treat independent certification of local operation as an important factor when choosing a technology provider.
For financial institutions and fintechs that use document scanning during customer onboarding, on-device processing limits the transfer of identity data to external servers. Independent certification provides a way to verify a provider’s claims about local processing, rather than relying on the provider’s own description of how data is handled.
