{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "shufti", "name": "Shufti", "vendor": "Shufti Pro Limited", "vendorUrl": "https://shuftipro.com", "kind": "http-api", "category": "identity-verification", "summary": "Identity and business verification service from Shufti Pro Limited in London. One REST endpoint runs document, face, address, AML screening and KYB checks chosen in the request body, with results by callback. A hosted MCP server exposes 25 tools.", "url": "https://www.anchorterminal.com/tools/shufti", "markdownUrl": "https://www.anchorterminal.com/tools/shufti.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shufti.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shufti.json", "repo": "https://github.com/shuftipro/iOS-SDK", "license": "Proprietary service under Shufti's Terms and Conditions. The licences of the mobile capture SDKs were not checked", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.shuftipro.com", "packages": [ { "registry": "npm", "name": "shuftipro-onsite-mobilesdk" } ], "auth": "mixed", "authNotes": "Self-serve. Signing up creates a back office account, and the Client ID and Secret Key come from Settings, API Configuration, API Keys. The REST API takes them as HTTP Basic auth, or a Bearer access token from `/get/access/token` that lasts one hour. The key pair has no scopes, and the Secret Key is shown once and replaced by generating a new one. The MCP server uses OAuth 2.1 with PKCE and dynamic client registration. Its login page asks for the same Client ID and Secret Key, and it issues tokens with the scopes `knowledge:read`, `verification:read` and `verification:write`. Callback and redirect domains must be registered in the back office.", "pricing": "freemium", "pricingNotes": "Free Forever covers up to 10 verifications a month with no card, on the production environment. Essentials starts from $1.50 a verification, pay as you go with no monthly minimum, up to 20,000 verifications. Enterprise is quoted by sales and adds e-IDV, Travel Rule, video KYC and other services. The pricing page says only successful verification attempts are billed and resubmissions are free. Trial accounts accept test ID samples (https://shuftipro.com/pricing/, checked 2026-10-09).", "priceSummary": "$1.50 / tx", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs (llms-full.txt), the pricing page or the terms (checked 2026-10-09).", "endpoints": [] }, "toolCount": 25, "popularity": { "githubStars": null, "npmWeekly": 673, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://developers.shuftipro.com/docs/get_started", "llmsTxt": "https://developers.shuftipro.com/llms.txt", "capabilities": [ "kyc.identity", "kyc.documents", "kyc.business", "kyc.screening" ], "tags": [ "hosted", "api-key", "oauth", "mcp", "webhooks", "llms-txt", "free-tier", "no-card", "status-page", "sla", "soc2", "iso27001" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 57.8, "grade": "C", "agentReady": false, "rank": 538, "ranked": true, "rankOf": 842, "categoryRank": 9, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 47, "maintenance": 72, "payments": 35, "reliability": 65, "schema": 58, "security": 62, "transparency": 71 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 65, "points": 13, "reason": "Graded on the REST API with the hosted lines. A status page at status.shuftipro.com, hosted by UptimeRobot, with 90-day uptime and an update history (20). The page draws its data by script from a path its robots.txt disallows, so no incident record was read and the line takes the no-readable-history score (5). Rate limits are published at 60 requests a minute per IP address for production accounts and 20 for trial accounts (15). A 429 is in the HTTP code table. No Retry-After header, backoff guidance or idempotency key was found. Failed callbacks retry automatically and can be resent by API once an hour (5). Schedule 1 of the public terms targets 99 per cent monthly uptime on a reasonable endeavours basis, with no service credits found (10). The REST API is generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 58, "points": 9.43, "reason": "No OpenAPI file or other machine-readable contract was found. Postman collections are linked from the endpoint pages, and the MCP tool schemas sit behind OAuth and were not read (5). llms.txt, a 2.9 MB llms-full.txt and a Markdown twin of every page (10). Each service has a how-it-works page and parameter tables that state purpose, and the MCP tool list gives one line a tool (12). Parameter tables give type, length limits, accepted values and required flags, though most flags are strings holding 0 or 1 and every service shares one endpoint (10). Samples in nine languages, an HTTP code table, an events table, sample responses per event and decline codes per service (13). The API has no version in its URL or headers. The revision history is dated and frequent, and its published page contains unresolved merge conflict markers (8)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 47, "points": 7.64, "reason": "REST responses can't be trimmed by field, and AML and e-IDV responses are long. The MCP server has 25 tools, a knowledge-only scope, and status answers built from a fixed list of fields (12). No endpoint lists verifications, so every read needs a stored reference. Paging was found only on Travel Rule transactions (6). Errors name the service, the key and a message, with HTTP codes and decline codes documented (15). No idempotency key. The caller's `reference` identifies a request and a 409 is listed, but the docs do not say a repeated reference is refused. The MCP delete tool asks for explicit confirmation, and tool annotations were not read (7). A request needs only a reference and one service object, and the MCP server fills defaults and reports them in `defaults_applied`. No server-side SDK in any language (7)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 62, "points": 10.85, "reason": "The REST API uses one Client ID and Secret Key pair as Basic auth, with no scopes. The secret is shown once and replaced by generating a new one, and a one-hour access token is an alternative. The MCP server adds OAuth 2.1 with PKCE, three scopes, 24-hour access tokens and rotating refresh tokens, though its login page takes the same key pair and stores the secret encrypted (22). MCP scopes are enforced when tools are listed and on every call, the delete tool needs confirmation, callback domains must be registered, and the back office has five preset roles plus custom ones. No read-only REST key (12). MCP status answers leave out extracted document data and the provider payload by design. REST responses carry text read from documents and watchlist hits, with no injection guidance found (7). Callback logs, a login history and an activity log for screening cases. MCP usage records are kept by Shufti and not shown to the operator (9). SOC 2 Type II, ISO 27001:2022, PCI DSS and Cyber Essentials Plus per the certifications page. security.txt returns 404, and no disclosure policy or bug bounty was found (12)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 35, "points": 4.38, "reason": "No x402, MPP or L402 (0). The pricing page gives $0 for Free Forever and a starting price of $1.50 a verification for Essentials, with the rate varying by volume and service and Enterprise quoted. We scored 15 of 20 because only a starting price is public (15). Free Forever covers 10 verifications a month with no card (20). Signup is a browser flow and keys come from the back office. The MCP server's Explore Shufti mode needs no account but reaches only the knowledge tools (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 72, "points": 6.3, "reason": "The revision history's newest entry is dated 6 October 2026 (30). It has 19 dated entries between 24 July and 6 October 2026 (20). Closed service with a public revision history, a tech support address and a help desk described in the terms. No public developer forum was found (9). No server appears in the official MCP registry and there is no server-side SDK. The mobile SDKs are current, with Android 3.0.8 dated 31 August 2026 (8). The npm package `shuftipro-onsite-mobilesdk` is at 1.1.2 with 673 downloads in the week to 4 October 2026. CI was not checked (5)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 71, "points": 6.21, "note": "editorial 51, provenance 90", "reason": "Closed service with public terms, version 11.1 with effect from 13 May 2026, and every earlier version linked (15). The Services Privacy Notice, version 1.2 of September 2026, sets out processor and controller roles and a retention schedule, and the terms carry a data processing schedule. The terms keep personal data for seven years after the services end where the client gives no instruction, and both documents say Shufti may act as independent controller for model training. The notice's United States section gives twelve months as the default for other verification data, which differs from the terms (22). Deprecations appear in the revision history with dates. Standard KYB was deprecated on 6 October 2026 with its pages removed the same day and no notice period, while the terms promise ten business days' written notice of non-security updates (8). Sub-processors are described by category and the list is given to clients on request. Webhook IP addresses are published for Europe and the United States (6)." } ], "assessment": { "date": "2026-10-09", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "REST responses can't be trimmed by field, and AML and e-IDV responses are long. The MCP server has 25 tools, a knowledge-only scope, and status answers built from a fixed list of fields (12). No endpoint lists verifications, so every read needs a stored reference. Paging was found only on Travel Rule transactions (6). Errors name the service, the key and a message, with HTTP codes and decline codes documented (15). No idempotency key. The caller's `reference` identifies a request and a 409 is listed, but the docs do not say a repeated reference is refused. The MCP delete tool asks for explicit confirmation, and tool annotations were not read (7). A request needs only a reference and one service object, and the MCP server fills defaults and reports them in `defaults_applied`. No server-side SDK in any language (7).", "maintenance": "The revision history's newest entry is dated 6 October 2026 (30). It has 19 dated entries between 24 July and 6 October 2026 (20). Closed service with a public revision history, a tech support address and a help desk described in the terms. No public developer forum was found (9). No server appears in the official MCP registry and there is no server-side SDK. The mobile SDKs are current, with Android 3.0.8 dated 31 August 2026 (8). The npm package `shuftipro-onsite-mobilesdk` is at 1.1.2 with 673 downloads in the week to 4 October 2026. CI was not checked (5).", "payments": "No x402, MPP or L402 (0). The pricing page gives $0 for Free Forever and a starting price of $1.50 a verification for Essentials, with the rate varying by volume and service and Enterprise quoted. We scored 15 of 20 because only a starting price is public (15). Free Forever covers 10 verifications a month with no card (20). Signup is a browser flow and keys come from the back office. The MCP server's Explore Shufti mode needs no account but reaches only the knowledge tools (0).", "reliability": "Graded on the REST API with the hosted lines. A status page at status.shuftipro.com, hosted by UptimeRobot, with 90-day uptime and an update history (20). The page draws its data by script from a path its robots.txt disallows, so no incident record was read and the line takes the no-readable-history score (5). Rate limits are published at 60 requests a minute per IP address for production accounts and 20 for trial accounts (15). A 429 is in the HTTP code table. No Retry-After header, backoff guidance or idempotency key was found. Failed callbacks retry automatically and can be resent by API once an hour (5). Schedule 1 of the public terms targets 99 per cent monthly uptime on a reasonable endeavours basis, with no service credits found (10). The REST API is generally available (10).", "schema": "No OpenAPI file or other machine-readable contract was found. Postman collections are linked from the endpoint pages, and the MCP tool schemas sit behind OAuth and were not read (5). llms.txt, a 2.9 MB llms-full.txt and a Markdown twin of every page (10). Each service has a how-it-works page and parameter tables that state purpose, and the MCP tool list gives one line a tool (12). Parameter tables give type, length limits, accepted values and required flags, though most flags are strings holding 0 or 1 and every service shares one endpoint (10). Samples in nine languages, an HTTP code table, an events table, sample responses per event and decline codes per service (13). The API has no version in its URL or headers. The revision history is dated and frequent, and its published page contains unresolved merge conflict markers (8).", "security": "The REST API uses one Client ID and Secret Key pair as Basic auth, with no scopes. The secret is shown once and replaced by generating a new one, and a one-hour access token is an alternative. The MCP server adds OAuth 2.1 with PKCE, three scopes, 24-hour access tokens and rotating refresh tokens, though its login page takes the same key pair and stores the secret encrypted (22). MCP scopes are enforced when tools are listed and on every call, the delete tool needs confirmation, callback domains must be registered, and the back office has five preset roles plus custom ones. No read-only REST key (12). MCP status answers leave out extracted document data and the provider payload by design. REST responses carry text read from documents and watchlist hits, with no injection guidance found (7). Callback logs, a login history and an activity log for screening cases. MCP usage records are kept by Shufti and not shown to the operator (9). SOC 2 Type II, ISO 27001:2022, PCI DSS and Cyber Essentials Plus per the certifications page. security.txt returns 404, and no disclosure policy or bug bounty was found (12).", "transparency": "Closed service with public terms, version 11.1 with effect from 13 May 2026, and every earlier version linked (15). The Services Privacy Notice, version 1.2 of September 2026, sets out processor and controller roles and a retention schedule, and the terms carry a data processing schedule. The terms keep personal data for seven years after the services end where the client gives no instruction, and both documents say Shufti may act as independent controller for model training. The notice's United States section gives twelve months as the default for other verification data, which differs from the terms (22). Deprecations appear in the revision history with dates. Standard KYB was deprecated on 6 October 2026 with its pages removed the same day and no notice period, while the terms promise ten business days' written notice of non-security updates (8). Sub-processors are described by category and the list is given to clients on request. Webhook IP addresses are published for Europe and the United States (6)." }, "sources": [ { "what": "developer docs index (llms.txt)", "url": "https://developers.shuftipro.com/llms.txt", "seen": "2026-10-09" }, { "what": "full developer docs (llms-full.txt)", "url": "https://developers.shuftipro.com/llms-full.txt", "seen": "2026-10-09" }, { "what": "get started and authentication", "url": "https://developers.shuftipro.com/docs/get_started", "seen": "2026-10-09" }, { "what": "endpoints (status, delete, account info, access token)", "url": "https://developers.shuftipro.com/docs/verification_endpoints/requests", "seen": "2026-10-09" }, { "what": "responses, HTTP codes, events and signature", "url": "https://developers.shuftipro.com/docs/verification_endpoints/responses", "seen": "2026-10-09" }, { "what": "callback logs and resend", "url": "https://developers.shuftipro.com/docs/verification_endpoints/callback_logs", "seen": "2026-10-09" }, { "what": "rate limits and webhook IPs", "url": "https://developers.shuftipro.com/docs/kyc/system_insights_and_request_limits/rate_limiting_and_webhook_ips", "seen": "2026-10-09" }, { "what": "revision history", "url": "https://developers.shuftipro.com/docs/revision_history", "seen": "2026-10-09" }, { "what": "MCP introduction", "url": "https://developers.shuftipro.com/docs/mcp/intro", "seen": "2026-10-09" }, { "what": "MCP tools", "url": "https://developers.shuftipro.com/docs/mcp/tools", "seen": "2026-10-09" }, { "what": "MCP privacy notice", "url": "https://developers.shuftipro.com/docs/mcp/privacy-notice", "seen": "2026-10-09" }, { "what": "MCP OAuth discovery document", "url": "https://ai.shuftipro.com/.well-known/oauth-authorization-server", "seen": "2026-10-09" }, { "what": "back office account settings and roles", "url": "https://developers.shuftipro.com/docs/backoffice/account_settings", "seen": "2026-10-09" }, { "what": "Android SDK changelog", "url": "https://developers.shuftipro.com/docs/mobile/changelog/android-changelog", "seen": "2026-10-09" }, { "what": "pricing", "url": "https://shuftipro.com/pricing/", "seen": "2026-10-09" }, { "what": "terms summary page and version list", "url": "https://shuftipro.com/terms-and-conditions/", "seen": "2026-10-09" }, { "what": "Terms and Conditions version 11.1 (PDF)", "url": "https://shuftipro.com/wp-content/uploads/Version-11.1-w.e.f.-May-13th-2026.pdf", "seen": "2026-10-09" }, { "what": "Services Privacy Notice", "url": "https://shuftipro.com/services-privacy-notice/", "seen": "2026-10-09" }, { "what": "certifications", "url": "https://shuftipro.com/certifications.md/", "seen": "2026-10-09" }, { "what": "status page", "url": "https://status.shuftipro.com/", "seen": "2026-10-09" }, { "what": "security.txt (404)", "url": "https://shuftipro.com/.well-known/security.txt", "seen": "2026-10-09" }, { "what": "npm shuftipro-onsite-mobilesdk", "url": "https://registry.npmjs.org/shuftipro-onsite-mobilesdk/latest", "seen": "2026-10-09" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0.1/servers?search=shufti", "seen": "2026-10-09" }, { "what": "RDAP for shuftipro.com", "url": "https://rdap.verisign.com/com/v1/domain/shuftipro.com", "seen": "2026-10-09" }, { "what": "lead URL, a parked domain", "url": "https://shufti.ai/", "seen": "2026-10-09" } ], "openQuestions": [ "unchecked: the incident history on status.shuftipro.com, which loads from /api/, a path its robots.txt disallows", "unchecked: the Vanta trust centre at trust.shuftipro.com, which is drawn by script, so the certification reports and any sub-processor list there were not read", "unchecked: the MCP tool definitions, annotations and input schemas, which sit behind OAuth. We did not connect to the server", "unchecked: GitHub stars and the licences of the mobile SDK repositories. The GitHub API refused us for its rate limit", "Whether clients were told in advance of the 14 September 2026 change that replaced decline code SPDR398 with SPDR370 for United States driving licences. The revision history entry carries the same date as the change, and no deduction was taken", "Whether a repeated `reference` is refused. A 409 is listed without saying when it is returned", "The Get Started page says an access token is valid for one hour and can be used once only, and the endpoint page says it applies for one hour. We did not test which holds", "Whether the Free Forever plan asks for no card at signup. The pricing page says so and we did not sign up", "The default retention period. The terms say seven years after the services end and the privacy notice's United States section says twelve months", "The lead named shufti.ai as the vendor URL. It is a parked domain for sale, and the vendor's site is shuftipro.com. The lead also did not mention the MCP server", "npmWeekly is `shuftipro-onsite-mobilesdk` (28 September to 4 October 2026), a React Native capture SDK, since no server-side package exists" ] }, "negative": 0, "verdict": "One endpoint covers document, face, address, AML and KYB checks, with a free plan of 10 verifications a month, and a hosted MCP server adds OAuth with three scopes. No OpenAPI file, server SDK or idempotency key was found, and the status page history could not be read.", "bestFor": "A team that wants document, face, address, AML and KYB checks behind one endpoint, a free plan for low volume, and an MCP server that hands the person a hosted verification link.", "strengths": [ "Free Forever plan of 10 verifications a month with no card, on the production environment, per the pricing page", "Hosted MCP server at `https://ai.shuftipro.com/mcp` with 25 tools, OAuth 2.1 with PKCE and three scopes enforced on every call", "Docs published as llms.txt, a 2.9 MB llms-full.txt and a Markdown twin of each page, with samples in nine languages", "Public terms (version 11.1, 13 May 2026) include an availability schedule targeting 99 per cent monthly uptime", "Revision history with 19 dated entries between 24 July and 6 October 2026" ], "weaknesses": [ "No OpenAPI file or other machine-readable contract was found. The reference is prose tables plus Postman collections", "The REST credential is one Client ID and Secret Key pair with no scopes, sent as Basic auth on every call", "No idempotency key, Retry-After header or backoff guidance was found for the documented 429", "No server-side SDK. Official packages cover Android, iOS, Flutter, React Native and Cordova capture only", "Standard KYB was deprecated on 6 October 2026 and its pages removed the same day, with no notice period stated", "The sub-processor list is available to clients on request only, and security.txt returns 404" ], "agentNotes": [ "POST every verification to `https://api.shuftipro.com/` with a unique `reference` of 6 to 250 characters and one object per service. Read results from `/status` with that reference", "Register the callback domain in the back office first. An unregistered `callback_url` is rejected", "Stay under 60 requests a minute per IP on a production account and 20 on a trial account", "Check the `Signature` response header. Accounts created after 15 March 2023 hash the Secret Key with SHA-256 before appending it to the raw response", "Through MCP, identity checks return a `verification_url` for the person to open. No tool accepts an image, so use the REST API for offsite proofs" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.8 } ], "editorialScores": { "ergonomics": 47, "maintenance": 72, "payments": 35, "reliability": 65, "schema": 58, "security": 62, "transparency": 51 }, "provenanceScore": 90 }, "connect": { "http": "curl --location --request POST 'https://api.shuftipro.com' \\\n--header 'Content-Type: application/json' \\\n--header 'Authorization: Basic \u003cbase64 of CLIENT_ID:SECRET_KEY\u003e' \\\n--data-raw '{\n \"reference\" : \"1234567\",\n \"callback_url\" : \"https://yourdomain.com/profile/notifyCallback\",\n \"country\" : \"GB\",\n \"language\" : \"EN\",\n \"verification_mode\" : \"any\",\n \"face\" : {\n \"proof\" : \"\"\n }\n}'", "claudeCode": "claude mcp add --transport http shufti https://ai.shuftipro.com/mcp", "config": { "mcpServers": { "shufti": { "args": [ "mcp-remote", "https://ai.shuftipro.com/mcp" ], "command": "npx" } } } }, "letme": { "capability": "https://letme.dev/kyc.identity", "tool": "https://letme.dev/shufti" }, "notable": [ "A single endpoint, `https://api.shuftipro.com/`, serves every service, and the services wanted are sent as objects in the JSON body (https://developers.shuftipro.com/llms.txt)", "The hosted MCP server lists 25 tools, 7 for product knowledge and 18 for verification, and accepts no document image or selfie (https://developers.shuftipro.com/docs/mcp/tools)", "The MCP privacy notice, version 1.2 of 25 September 2026, says access tokens expire after 24 hours and the Secret Key is stored encrypted until the token record is deleted (https://developers.shuftipro.com/docs/mcp/privacy-notice)", "Production accounts are limited to 60 requests a minute per IP address and trial accounts to 20 (https://developers.shuftipro.com/docs/kyc/system_insights_and_request_limits/rate_limiting_and_webhook_ips)", "Free Forever covers 10 verifications a month with no card, Essentials starts from $1.50 a verification and Enterprise is quoted (https://shuftipro.com/pricing/)", "Standard KYB was deprecated on 6 October 2026 in favour of Enhanced KYB, and its pages were removed (https://developers.shuftipro.com/docs/revision_history)", "The published revision history page contains unresolved merge conflict markers around its 5 and 6 October 2026 entries (https://developers.shuftipro.com/docs/revision_history.md)", "The terms, version 11.1 with effect from 13 May 2026, target 99 per cent monthly uptime and say Shufti may act as independent controller for model training (https://shuftipro.com/terms-and-conditions/)", "The lead URL shufti.ai is a parked domain listed for sale on Spaceship and is not the vendor's site (https://shufti.ai/)", "No Shufti server appears in the official MCP registry (https://registry.modelcontextprotocol.io/v0.1/servers?search=shufti)" ], "area": "domain-data", "details": [ { "label": "Surface graded", "value": "REST API at `https://api.shuftipro.com/`, a single endpoint where each service is an object in the JSON body. The hosted MCP server is read as a second surface" }, { "label": "Endpoints", "value": "POST `/` (verification), `/status`, `/delete`, `/account/info/`, `/get/access/token`, a callback resend endpoint and a proof access URL valid for 15 minutes" }, { "label": "Services", "value": "Document, second document, face, address, consent, phone and email one-time codes, AML screening for people and businesses, Enhanced KYB, e-IDV Pro database checks, age verification, video KYC, e-signature, crypto wallet screening, Travel Rule and transaction screening" }, { "label": "MCP server", "value": "`https://ai.shuftipro.com/mcp`, Streamable HTTP, OAuth 2.1 with PKCE and dynamic client registration. 25 tools, 7 knowledge and 18 verification. Scopes `knowledge:read`, `verification:read` and `verification:write`" }, { "label": "Credentials", "value": "Client ID and Secret Key as HTTP Basic auth, or a Bearer access token from `/get/access/token` valid for one hour. The Secret Key is shown once and regenerated in the back office" }, { "label": "Rate limits", "value": "60 requests a minute per IP address on a production account, 20 a minute on a trial account. Shufti says the limits can change and can be raised on request" }, { "label": "Callbacks", "value": "Sent to a registered `callback_url` with a `Signature` header. Failed deliveries retry automatically, and a callback can be resent by API or from the back office once an hour" }, { "label": "Webhook IPs", "value": "Two in Europe and four in the United States, listed in the docs" }, { "label": "Errors", "value": "JSON with an `event` such as `request.invalid` and an `error` object naming the service, the key and a message. HTTP codes 400, 401, 402, 403, 404, 409, 429, 500, 504 and 524 are listed, and decline reasons carry codes such as SPDR370" }, { "label": "Testing", "value": "Trial accounts accept published test ID samples for face, document and address checks. The samples do not work on a production account" }, { "label": "SDKs", "value": "Capture SDKs only. Android 3.0.8 (31 August 2026), iOS 1.3.55, Flutter 1.0.33, React Native 1.1.1 and Cordova. No server-side client library" }, { "label": "Retention", "value": "Seven years after the services end where the client gives no instruction, per the terms. Records can be deleted by API with a reference and a comment" }, { "label": "Certifications", "value": "SOC 2 Type II, ISO 27001:2022, PCI DSS, Cyber Essentials Plus and iBeta PAD Level 3 per shuftipro.com/certifications. The Vanta trust centre at trust.shuftipro.com was not read" }, { "label": "Status", "value": "status.shuftipro.com, hosted by UptimeRobot, with 90-day uptime and an update history drawn by script" } ], "unitPrices": [ { "item": "Verification, Free Forever plan (document and face checks)", "unit": "tx", "usd": 0, "note": "up to 10 verifications a month, no card" }, { "item": "Verification, Essentials plan, starting price", "unit": "tx", "usd": 1.5, "note": "rate depends on volume and the services chosen, up to 20,000 verifications" } ], "provenance": { "legalEntity": "Shufti Pro Limited", "domain": "shuftipro.com", "domainRegistered": "2016-06-28", "endpointOnVendorDomain": true, "terms": "https://shuftipro.com/wp-content/uploads/Version-11.1-w.e.f.-May-13th-2026.pdf", "privacy": "https://shuftipro.com/services-privacy-notice/", "statusPage": "https://status.shuftipro.com", "changelog": "https://developers.shuftipro.com/docs/revision_history", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The terms and the MCP privacy notice name Shufti Pro Limited, Office 408 Coppergate House, 10 Whites Row, London E1 7NF.", "The governing terms are a PDF, version 11.1, linked from shuftipro.com/terms-and-conditions/, which itself carries only a summary and links to every earlier version. The page labels the file 12 May 2026 and the file name says 13 May.", "The privacy link is the Services Privacy Notice, version 1.2, last updated September 2026, which covers verification data. A separate notice covers the website.", "shuftipro.com/.well-known/security.txt answered 502 on the first request and 404 on the second.", "RDAP for shuftipro.com gives a registration date of 2016-06-28.", "The API answers at api.shuftipro.com and the MCP server at ai.shuftipro.com. The lead's shufti.ai is a parked domain for sale and unrelated to the vendor.", "status.shuftipro.com is an UptimeRobot page whose data loads from /api/, a path its robots.txt disallows, so the incident history was not read." ], "score": 90, "checks": [ { "check": "Legal entity named", "value": "Shufti Pro Limited", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "shuftipro.com, registered 2016-06-28 (10 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.shuftipro.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.shuftipro.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://shuftipro.com/wp-content/uploads/Version-11.1-w.e.f.-May-13th-2026.pdf", "state": "not-read", "points": 10, "max": 10 }, { "kind": "privacy", "url": "https://shuftipro.com/services-privacy-notice/", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-09-01", "words": 7975, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated September 2026", "says": "Last updated 2026-09-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "California residents can also ask for the categories we collect, where we got them, why we use them, who we gave them to, and the specific pieces we hold." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Where we do use biometric data elsewhere to improve our own systems, we keep it no more than 24 months, strip out what identifies you wherever we can, and never pass it to anyone else for that purpose.", "says": "Names a period of 24 months" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Clients are notified of any intended material changes to the sub-processor list with reasonable advance notice, providing an opportunity to object where contractually permitted." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We have not sold personal information, or shared it for cross-context behavioural advertising, at any point in the last twelve months, and we do not do so now.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "The DPO operates independently and reports to the highest level of management in accordance with Article 38 UK GDPR." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "The DPO operates independently and reports to the highest level of management in accordance with Article 38 UK GDPR.", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "EU–US Data Privacy Framework: Commission adequacy decision (Implementing Decision 2023/1795) for flows to certified US companies.", "says": "Relies on the Data Privacy Framework" } ], "toKnow": [ { "key": "training.optout", "label": "Says it may use customer content to train or improve models, and gives an opt-out", "found": true, "quote": "Shufti may also act as an independent controller where processing is necessary for model training, fraud prevention, service security and product improvement, as Shufti's Terms explicitly state." } ], "notes": [ { "date": "2026-10-08", "text": "Data that clients collect and pass to Shufti by API or back office is not used for service improvement or training unless agreed with the client in writing.", "quote": "This data is not used for service improvement and training purposes unless otherwise agreed with the client in writing." }, { "date": "2026-10-08", "text": "The one significant decision Shufti says it makes itself is blocking a session for fraud across its platform.", "quote": "The one significant decision we make ourselves is blocking a session for fraud across our platform." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shufti.json", "live": { "slug": "shufti", "probe": { "target": "https://api.shuftipro.com", "method": "get", "lastAt": "2026-10-09T09:27:04.678373332Z", "lastOk": true, "lastStatus": 200, "lastMs": 358, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 311, "p95ms24h": 342, "samples24h": 20, "samples30d": 20, "days": [ { "date": "2026-10-09", "probes": 20, "ok": 20 } ] }, "vendorStatus": { "page": "https://status.shuftipro.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-09T07:58:32.112017753Z" }, "updatedAt": "2026-10-09T09:27:04.678373332Z" } } }