The Privacy-preserving Identity Pipeline in KYC

KYC sits on a paradox: regulators demand strong identity proofs, but every byte of identity data a service stores becomes a permanent breach surface. The traditional answer: collect documents, run checks, file them away, turns every KYC provider into a high-value target and every user into a permanent disclosure.

This talk walks through an alternative pipeline now running in zkKYC field, where a stack of well-chosen cryptographic primitives composes into a system that proves claims about a user: their passport is valid, they are over 18, they are the same person who registered last month, without the server ever seeing their identity data. The journey spans device-bound keys, encrypted identity storage, government-signed document chains, biometric commitments, zero-knowledge proofs, and authenticated claim delivery but the goal throughout is to show how these pieces fit together, not to dwell on any single one.

Designed for engineers and product folks alike, the talk explains each primitive at a high level (no math), focuses on system design and uses architecture diagrams throughout. By the end, you will follow how the same passport scan that validates a user's age also produces a server-blind, unlinkable proof — and why this is starting to look like the only sustainable way to do identity at scale.

Takeaways: a vocabulary for evaluating privacy-preserving identity systems, a concrete reference architecture, and an honest list of open problems (biometric revocation, post-quantum SNARKs, deduplication without linkability) this design has not yet solved.