Digital Identity Verification with 100% PII Protection
Overview
Gen Digital’s Midy by Norton is a digital credential platform that provides online identity verification services, helping businesses authenticate users while staying compliant with privacy regulations.
Euristiq helped develop Midy by Norton as a secure and scalable system to simplify digital identity verification and onboarding. The goal was to make the process easier for users while ensuring compliance with privacy regulations. Our team improved how digital identities are verified, optimised system performance, and compared OCR (Optical Character Recognition) providers to find the best solution — helping Midy streamline user onboarding, reduce risks related to personal data, and improve overall security.

Our client in numbers
users globally across Gen Digital’s family of trusted brands
countries served, blocking 14.5B+ attacks and 29M mobile malware threats
attacks blocked per minute, on average
About the product Euristiq worked on
Rigid onboarding & presentation
The onboarding and presentation process couldn’t handle product requests efficiently — most changes required code updates or infrastructure work.
Strict PII compliance
The system had to avoid processing users’ personally identifiable information (PII) unless explicitly requested, to stay compliant with privacy regulations.
Async scalability limits
The event-driven architecture that decoupled services needed a more scalable approach — and a compliant streaming platform — to sustain growing demand.
API versioning & OCR evaluation
Java’s Spring frameworks didn’t natively route by API-version header, and the client needed a deep comparison of three OCR providers on a tight timeline.
Building a flexible, privacy-first identity verification platform
Onboarding flexibility & secure PII handling
The team redesigned the system’s component architecture for adaptability and developed secure protocols for digital credential onboarding — defining APIs, messaging, and interactions between mobile applications, backend microservices, and credential issuers. Encryption and decryption mechanisms protect sensitive data, and configuration-management APIs enable seamless credential verification without manual adjustments or infrastructure changes.
Scaling asynchronous event processing
To enhance scalability, Euristiq migrated over 18 microservices from Amazon SQS to Kafka messaging, significantly improving the platform’s ability to process high volumes of asynchronous events. Standardised libraries for Golang and Java microservices ensured consistency across services, and the team contributed to architecture design and message-format definition for better cross-team integration.
API versioning without duplicate endpoints
Because Spring and Spring Boot don’t natively route by API-version header, Euristiq implemented a custom ApiVersion annotation. Requests are routed dynamically based on the API-version header, so different API versions can execute specific logic without creating multiple endpoints — streamlining integration while keeping a consistent external API structure.
OCR provider evaluation
The team engaged directly with three OCR providers and built a Proof-of-Concept (PoC) in Golang for real-world testing and performance comparison. After analysing accuracy, performance, and integration capabilities, Euristiq delivered a detailed report and recommended the best-fit OCR provider — all within a short timeframe.
Monitoring, logging, tracing & eventing
To keep microservices reliable in production, Euristiq deployed enhanced monitoring dashboards, advanced logging and tracing, automated alerting via industry-standard channels, and standardised event specifications — fully embracing event-driven architecture with a migration to a more compliant streaming platform
AWS-managed database solutions built for scale and resilience
AWS EKS runs containerised workloads with automated scaling and management
AWS RDS & DocumentDB provide managed relational and NoSQL databases with high availabilit
AWS MSK delivers a fully managed Kafka service for real-time data streaming
A secure, scalable identity verification
service with 100% PII protection
100% PII protection
No identity data is stored without user consent; verification data is deleted immediately after processing — success or failure.
18+ microservices migrated
Moved from Amazon SQS to Kafka, boosting asynchronous event throughput and platform scalability.
3 OCR providers evaluated
A Golang PoC benchmarked accuracy and performance; Euristiq recommended the most efficient provider.
One-time document upload
Users verify once with a government-issued document plus biometrics, cutting redundancy and onboarding friction.
Document reuse detection
Anonymized identifiers let partners spot misuse against their own rules without ever seeing real identity data.
Configurable checks
Configuration-management APIs let clients customise verification checks on demand — no code or infrastructure changes.
Need help with KYC
or identity verification service?
or scaling an existing identity verification solution — Euristiq brings the engineering depth
and the embedded-team model that clients like Norton trust.
FAQ
What is a digital identity verification service?
A digital identity verification service confirms that a person is who they claim to be by validating government-issued documents, biometrics, and personal data without a physical, in-person check. For Midy by Norton, Euristiq built this as a digital credential platform: users upload an ID once, complete biometric verification, and partners then confirm authenticity without ever accessing or storing the underlying identity data. The result is faster onboarding, lower fraud risk, and privacy-by-design compliance. Because verification data is deleted immediately after processing, the service delivers 100% PII protection with explicit user consent.
How does digital credential onboarding work?
Digital credential onboarding lets a user prove their identity a single time and reuse that verified credential across partner services. In Midy by Norton, Euristiq designed secure onboarding protocols defining the APIs, messaging, and interactions between mobile apps, backend microservices, and credential issuers. Encryption and decryption protect data in transit, and configuration-management APIs let clients add or adjust verification checks without code changes or infrastructure updates. The one-time document upload removes redundancy and friction, so users complete onboarding faster while partners receive only the confirmation they need, never the raw identity data.
How do you verify identity without storing personal data (PII)?
You verify identity without storing personally identifiable information (PII) by processing verification data in memory and deleting it the moment the check completes, success or failure. Midy by Norton assigns anonymized identifiers to detect document reuse and fraud, so partners can monitor misuse without ever seeing real identity data. Fuzzy name-matching confirms a user’s legal name while allowing minor variations, and results are shared only with explicit consent. If a user abandons the flow or the system fails, all data is auto-deleted by predefined rules. This privacy-first design gives the platform 100% PII protection.
How do you scale identity verification for high demand?
To scale identity verification for high demand, Euristiq migrated more than 18 microservices from Amazon SQS to Kafka, giving Midy by Norton a far more capable asynchronous, event-driven backbone for processing verification events at volume. Standardized Golang and Java libraries kept services consistent, a custom ApiVersion annotation routed requests by API-version header without duplicate endpoints, and enhanced monitoring, logging, and tracing gave the team real-time visibility without sacrificing system stability. Running on AWS EKS, RDS, DocumentDB, ElastiCache, and MSK, the platform maintains high availability and performance as load grows.
Can clients customize identity verification checks?
Yes. Euristiq built configuration-management APIs into Midy by Norton so clients can manage and customize verification checks on demand, adding, adjusting, or removing checks without code changes or infrastructure updates. This flexibility was a core requirement: the original onboarding and presentation process was rigid and often needed engineering work for each product request. The new component architecture makes the service adaptable, so partners can tune verification to their own business rules and compliance needs while the platform continues to protect personal data by default.







