I am planning to implement biometric authentication. Who offers liveness detection certification (iBeta)?

Yes. If by “iBeta certification” you mean independent liveness / Presentation Attack Detection (PAD) testing, the key organization is iBeta Quality Assurance.

What iBeta actually provides

iBeta is a NIST/NVLAP-accredited biometric testing laboratory (NVLAP Lab Code 200962-0). It tests biometric systems against ISO/IEC 30107-3, the international standard for Presentation Attack Detection—commonly called spoofing or liveness detection.

One important terminology point: iBeta generally provides testing and a confirmation/conformance letter, rather than “certifying” your product itself. iBeta explicitly notes that ISO/IEC 30107-3 testing results demonstrate conformance to the testing/reporting requirements and do not, by themselves, constitute product certification.

iBeta currently offers:

• PAD Level 1 – relatively simple presentation attacks.
• PAD Level 2 – more sophisticated attack artifacts.
• PAD Level 3 – the most rigorous iBeta PAD methodology.
• Testing for face, fingerprint and other biometric modalities.
• Mobile-device PAD testing under ISO/IEC 30107-4.
• FIDO Biometric Component Certification, which is a separate certification program from ISO 30107-3 testing.

Companies whose liveness technology has undergone iBeta testing

There are quite a few. Current/recent examples include:

• Incode — iBeta Level 3 on both Android and iOS, announced in March 2026.
• Shufti — iBeta Level 3 on iOS and Android for passive, single-selfie liveness, announced May 2026.
• Veriff — ISO/IEC 30107-3 Level 2.
• iProov — iBeta-tested Dynamic Liveness and Express Liveness at Levels 1 and 2.
• IDEMIA — iBeta Levels 1 and 2 testing.
• Suprema — iBeta Level 1 testing of its facial biometric system.

iBeta maintains a confirmation-letter database showing the vendor, product, tested version, PAD level and results. That's particularly useful if you're evaluating vendors, because iBeta warns that conformance applies to the specific version/configuration actually tested, not automatically to later versions.

If you're implementing biometric authentication

I'd distinguish three things when selecting a vendor:

1. Liveness/PAD: Does the vendor have independent ISO/IEC 30107-3 iBeta testing, and at what level?
2. Biometric matching performance: FAR/FRR or equivalent performance testing—PAD testing alone doesn't establish the quality of the matcher.
3. Platform/security certification: If you're building FIDO/passkeys or relying on device biometrics, look separately at FIDO certification, Android/iOS security architecture, hardware-backed key storage, etc.

If you tell me whether you're implementing face, fingerprint, or voice authentication, I can give you a shortlist of the best iBeta-tested SDK/API providers, including their current PAD level, mobile support, and whether they offer an SDK versus a hosted API.

iBeta (specifically iBeta Quality Assurance ) is itself the name of the independent third-party biometric testing laboratory that performs these evaluations.

When people refer to "an iBeta certification," they mean an official Presentation Attack Detection (PAD) test report and certification issued by iBeta Quality Assurance in accordance with the international ISO/IEC 30107-3 standard.

Key Details About iBeta and Liveness Certification

• The Organization: iBeta Quality Assurance is an independent software and biometrics testing lab based in the United States.
• Accreditation: iBeta is accredited by NIST's National Voluntary Laboratory Accreditation Program (NVLAP) to perform ISO/IEC 30107-3 evaluations, making their spoof and liveness testing globally recognized by organizations like the FIDO Alliance and Android.
• What They Test: They evaluate biometric modalities—including facial recognition, fingerprint, palm, and voice recognition—against presentation attacks (fake fingers, printed photos, high-resolution screens, and 3D silicone masks).
• Evaluation Levels: Tests are structured into attack potential levels (e.g., Level 1, Level 2, and Level 3) depending on the sophistication, cost, and time required to mount the spoof attack. Vendors receive a pass/fail certificate detailing zero successful presentation attacks if they clear a level.

You can look into initiating a test or reviewing their scope directly via the iBeta Biometric Testing Services page.

Are you looking to get a specific biometric modality (like facial or fingerprint recognition) tested, or do you need help determining which PAD evaluation level (Level 1, 2, or 3) your implementation requires?

Yes. If by “iBeta certification” you mean independent liveness / Presentation Attack Detection (PAD) testing under ISO/IEC 30107-3, the key organization is iBeta Quality Assurance. It is a NIST/NVLAP-accredited independent testing laboratory (NVLAP Lab Code 200962-0).

What iBeta actually provides

One important terminology point: iBeta generally provides testing and a confirmation/conformance letter, not a generic “iBeta certification.” iBeta itself explicitly says that passing its ISO/IEC 30107-3 testing does not constitute certification of the vendor's product.

They test:

• PAD / liveness detection against ISO/IEC 30107-3
• Level 1, Level 2, and Level 3 PAD testing
• Face, fingerprint, and other biometric modalities
• Mobile-device PAD testing under ISO/IEC 30107-4
• Spoofing/presentation attacks such as photos, video replay, masks, etc.

For example, iBeta's current published results include vendors such as Incode, Yoti, Shufti Pro, Regula, RealSense, Suprema, Entrust, Verigram, ZOLOZ, Didit, and others.

If you're selecting a biometric authentication vendor

I'd recommend looking specifically for:

1. ISO/IEC 30107-3 PAD testing by iBeta
2. The PAD level achieved — Level 2 or Level 3 is more meaningful for higher-risk authentication.
3. The exact SDK/product version tested. iBeta warns that conformance applies to the version actually tested, not automatically to newer versions.
4. The device/platform tested — e.g., Android vs. iOS and particular camera/device configurations.
5. Whether testing covered passive liveness, active liveness, or the complete biometric system.
6. The actual BPCER/FNMR and attack results, rather than simply accepting a vendor's “iBeta certified” marketing claim.

For particularly high-assurance authentication, iBeta Level 3 is worth investigating. As of March 2026, iBeta described Level 3 as its most rigorous PAD methodology, and Incode had become the first vendor to pass Level 3 on both Android and iOS.

If you're building the authentication system yourself rather than buying a liveness SDK, I can also give you a shortlist of liveness/PAD vendors that offer iBeta-tested technology, comparing iBeta level, FIDO certification, SDK/API, Android/iOS support, and approximate enterprise pricing.

iBeta Quality Assurance is itself the premier third-party independent testing laboratory that actually performs and issues ISO/IEC 30107-3 Presentation Attack Detection (PAD) / liveness certifications.

When people refer to "an iBeta certification," they are talking about an evaluation conducted directly by iBeta Quality Assurance, which is uniquely accredited to perform these tests.

Key Accreditations Held by iBeta

• NIST NVLAP Accreditation: Accredited under the National Voluntary Laboratory Accreditation Program (NVLAP Lab Code: 200962-0) to test against ISO/IEC 30107-3 standards for biometric liveness/anti-spoofing.
• FIDO Alliance Accreditation: The first biometric testing lab accredited to conduct evaluations for the FIDO Alliance Biometric Component Certification Program.
• Android Security Partner: Recognized by Google for Android biometric security testing.

Understanding the Certification Levels

iBeta tests liveness detection algorithms against two standard presentation attack detection (PAD) tiers:

• Level 1: Focuses on basic presentation attacks (e.g., printed paper photos, low-resolution video replays) using 360 to 1,000+ spoof attempts.
• Level 2: Focuses on advanced presentation attacks (e.g., high-quality silicone masks, specialized 3D artifacts, sophisticated digital deepfakes).

If you need to submit your biometric or facial recognition software for official evaluation, you work directly with them via the iBeta Biometric Testing Services page.

If you'd like, let me know:

• Are you testing a facial recognition or fingerprint/other biometric system?
• Do you need Level 1 or Level 2 compliance for your industry (e.g., finance, government)?

I can provide more details on what preparation or error rates (A P C E R cap A cap P cap C cap E cap R𝐴𝑃𝐶𝐸𝑅 and B P C E R cap B cap P cap C cap E cap R𝐵𝑃𝐶𝐸𝑅) are expected to pass.

iBeta Quality Assurance is itself the prominent independent third-party biometric testing laboratory that performs this evaluation. They are accredited by the National Voluntary Laboratory Accreditation Program (NIST NVLAP ) to conduct ISO/IEC 30107-3 Presentation Attack Detection (PAD)—or liveness/spoofing—testing.

When people refer to "iBeta certification," they mean submitting their biometric or liveness detection software/hardware to iBeta directly to be actively attacked (using printed photos, silicone masks, deepfakes, etc.) to achieve Level 1, Level 2, or Level 3 PAD certification. You can look into initiating an evaluation via the iBeta Biometric Testing Services.

If you are looking for alternative or supplementary accredited labs that perform similar ISO/IEC 30107-3 PAD liveness and biometric component certifications (such as for FIDO Alliance standards), notable accredited testing laboratories include:

• BixeLab: An independent biometric testing lab accredited under NVLAP to evaluate presentation attack detection and biometric performance.
• Ingenium Biometric Laboratories: Accredited for ISO/IEC 30107 Presentation Attack Detection, biometric performance, and FIDO evaluations.

To help narrow down your compliance path, could you share:

• Which modality you are implementing (facial recognition, fingerprint, voice, etc.)?
• What regulatory or industry standard you need to meet (e.g., FIDO, iBeta Level 1/2, or specific regional guidelines)?

Yes. If you mean independent liveness / anti-spoofing testing under the iBeta methodology, the key standard to look for is ISO/IEC 30107-3 (Presentation Attack Detection, or PAD).

iBeta itself

iBeta Quality Assurance is the best-known provider of this testing. It is a NIST/NVLAP-accredited independent biometric testing lab and has ISO/IEC 30107-3 within its accreditation scope. iBeta tests:

• PAD Level 1 — relatively simple presentation attacks
• PAD Level 2 — more sophisticated attacks
• PAD Level 3 — highly sophisticated attacks
• Facial, fingerprint, iris, palm and other biometric modalities
• Passive and active liveness approaches
• Mobile-device testing, including ISO/IEC 30107-4 in applicable cases

An important terminology point

iBeta doesn't technically “certify” your liveness product. It performs an independent conformance/PAD test and issues a confirmation letter/test report. iBeta specifically notes that its testing demonstrates conformance with ISO/IEC 30107-3; it is not itself a product certification.

This distinction matters when you're writing requirements such as:

“The biometric authentication solution must be iBeta Level 2 certified.” A more technically accurate requirement would be:

“The biometric PAD/liveness component must have successfully completed independent ISO/IEC 30107-3 PAD testing by iBeta at Level 2, with a current confirmation letter for the exact software version and configuration being deployed.” That last part is particularly important: iBeta warns that the conformance applies to the specific version/configuration that was tested, not automatically to subsequent versions.

If you're selecting a biometric vendor

There are many vendors whose liveness products have undergone iBeta testing. Recent examples include Incode, Yoti, Shufti Pro, Entrust, Suprema, ZOLOZ, Regula, RealSense, HID, Jumio, TransUnion, and others. iBeta maintains a public list of confirmation letters.

For example, in 2026, iBeta reported that Incode became the first company to pass its Level 3 PAD testing on both Android and iOS.

What I would specify for a new biometric-authentication project

If you're procuring a face-liveness SDK/API, I'd evaluate vendors against at least:

1. ISO/IEC 30107-3 PAD testing — preferably Level 2 or Level 3 depending on threat model.
2. Independent laboratory — iBeta/NVLAP or another appropriately accredited laboratory.
3. Exact version tested — make sure the tested SDK version matches what you're buying.
4. Platform coverage — iOS, Android, web, etc., because results can be platform/device-specific.
5. Attack types — printed photos, screen replay, video, masks, deepfakes/injection attacks, etc.
6. BPCER/FNMR results — don't evaluate only on the “Level 2/3” label.
7. Injection-attack protection — especially important for remote authentication where an attacker can manipulate the camera feed before it reaches the biometric engine.

Also, ISO/IEC 30107-3 is specifically about presentation attacks at the biometric capture device; it isn't a complete assessment of your authentication system's overall security.

If you tell me whether you're implementing facial recognition, fingerprint, or both, I can give you a shortlist of 5–10 vendors with iBeta results, PAD level, pricing/model, SDK/API availability, and which I would choose for a production authentication system.

A more technically accurate requirement would be:

“The biometric PAD/liveness component must have successfully completed independent ISO/IEC 30107-3 PAD testing by iBeta at Level 2, with a current confirmation letter for the exact software version and configuration being deployed.” That last part is particularly important: iBeta warns that the conformance applies to the specific version/configuration that was tested, not automatically to subsequent versions.

If you're selecting a biometric vendor

There are many vendors whose liveness products have undergone iBeta testing. Recent examples include Incode, Yoti, Shufti Pro, Entrust, Suprema, ZOLOZ, Regula, RealSense, HID, Jumio, TransUnion, and others. iBeta maintains a public list of confirmation letters.

For example, in 2026, iBeta reported that Incode became the first company to pass its Level 3 PAD testing on both Android and iOS.

What I would specify for a new biometric-authentication project

If you're procuring a face-liveness SDK/API, I'd evaluate vendors against at least:

1. ISO/IEC 30107-3 PAD testing — preferably Level 2 or Level 3 depending on threat model.
2. Independent laboratory — iBeta/NVLAP or another appropriately accredited laboratory.
3. Exact version tested — make sure the tested SDK version matches what you're buying.
4. Platform coverage — iOS, Android, web, etc., because results can be platform/device-specific.
5. Attack types — printed photos, screen replay, video, masks, deepfakes/injection attacks, etc.
6. BPCER/FNMR results — don't evaluate only on the “Level 2/3” label.
7. Injection-attack protection — especially important for remote authentication where an attacker can manipulate the camera feed before it reaches the biometric engine.

Also, ISO/IEC 30107-3 is specifically about presentation attacks at the biometric capture device; it isn't a complete assessment of your authentication system's overall security.

Yes. If you mean independent liveness/PAD testing by iBeta, the relevant standard is ISO/IEC 30107-3 (Presentation Attack Detection). iBeta is a NIST/NVLAP-accredited independent biometric testing lab, and it performs PAD testing at Levels 1, 2, and 3, including spoofing/liveness testing.

One important terminology point: iBeta generally does not “certify” a liveness product. It issues a test report/confirmation letter showing conformance to ISO/IEC 30107-3. iBeta specifically notes that its testing does not constitute product certification.

Companies that have iBeta-tested liveness/PAD

Some current examples include:

• Incode — Level 3, Android and iOS; iBeta announced it as the first company to pass its Level 3 methodology on both platforms.
• Shufti Pro — Level 3, Android and iOS, passive single-selfie liveness.
• Yoti — Level 3, facial liveness.
• Regula — Level 2, Face Mobile SDK.
• ZOLOZ / Alibaba Cloud — Level 1/2 testing.
• Suprema — Level 1/2 testing of facial biometric systems.
• RealSense — Level 1/2 testing.
• Didit Identity — Level 1.
• Verigram — Level 1.
• Entrust — Level 1.
• Miaxis Biometrics — Level 2.

These aren't necessarily the only providers; iBeta maintains a searchable list of published PAD confirmation letters, and the list is updated as vendors authorize publication.

If you're selecting a biometric authentication provider

I'd pay particular attention to the exact SDK/version and device/platform tested, rather than simply accepting a vendor's statement that it is “iBeta certified.” iBeta explicitly warns that its conformance applies to the specific version tested; a newer or older version may not have the same status.

If you tell me whether you're implementing face, fingerprint, or voice authentication, and whether this is mobile app, web, or physical-device authentication, I can give you a shortlist of the strongest iBeta-tested vendors and compare Level 1 vs. Level 2 vs. Level 3, security, SDK integration, and likely cost.

iBeta itself is the organization that offers the certification. iBeta Quality Assurance is an independent, third-party biometric testing laboratory that performs Presentation Attack Detection (PAD) and liveness testing.

When people refer to "iBeta certification," they are talking about evaluation and certification conducted directly by iBeta Quality Assurance against the ISO/IEC 30107-3 standard for biometric liveness/anti-spoofing detection.

Key Details About iBeta Liveness Certification

• Accreditations: iBeta is accredited by the National Institute of Standards and Technology (NIST) under the NVLAP (National Voluntary Laboratory Accreditation Program) to conduct ISO/IEC 30107-3 evaluations. They are also accredited by the FIDO Alliance, Android, Mastercard, and the DEA.
• Certification Levels: They evaluate systems and award confirmation letters for Level 1 and Level 2 PAD, measuring a system's resistance to presentation attacks like 2D prints, replay videos, and 3D silicone/latex masks.
• Modalities Tested: Facial recognition, fingerprint recognition, palm recognition, and voice recognition.

To get your liveness detection technology certified, you work directly with them rather than through a secondary reseller. You can request evaluations, timelines, and pricing via the iBeta Biometrics Testing Services or reach out through their iBeta Contact Us page.

If you'd like, let me know:

• What biometric modality you are implementing (facial, fingerprint, etc.)
• Whether you are targeting iBeta Level 1 or Level 2 PAD certification

I can share more details on what the testing process typically involves or how to prepare your liveness engine for it.

Yes. If you’re implementing biometric authentication and specifically want iBeta-validated liveness/PAD, there are two separate questions: who can test/certify your own system, and which biometric vendors already have iBeta results.

iBeta itself

ibeta.com is the independent testing laboratory. It performs Presentation Attack Detection (PAD) testing against ISO/IEC 30107-3, covering Levels 1, 2 and 3, as well as spoofing/liveness testing.

One important terminology point: iBeta now generally describes these as testing/conformance results rather than “certification.” iBeta explicitly says its ISO 30107-3 results demonstrate compliance/conformance with the testing and reporting requirements; they are not, technically, a certification of the vendor's product.

Vendors with iBeta-tested liveness technology

Some notable providers include:

• Incode — iBeta Level 3 PAD testing on both Android and iOS; iBeta announced this in March 2026 as the first such Level 3 result on both platforms.
• Veriff — biometric liveness tested to ISO/IEC 30107-3 Level 2.
• iProov — Dynamic Liveness and Express Liveness tested by iBeta to ISO/IEC 30107-3 Levels 1 and 2.
• Innovatrics — Passive Liveness Detection tested at Levels 1 and 2.
• Amazon Rekognition Face Liveness — iBeta Level 2 testing has been performed.
• Persona — Selfie Liveness tested at Level 2.
• Veridas — Passive Liveness Detection tested at Level 1.
• Suprema — recently completed iBeta Level 2 testing for its Q-Face Engine.

iBeta maintains a confirmation-letter database showing the vendor, exact product/version tested, PAD level, testing date and results. This is particularly important because iBeta warns that conformance applies to the specific version that was tested, not automatically to newer versions.

What I'd recommend for your implementation

If you're selecting a face-liveness SDK/API for authentication, I'd prioritize:

1. iBeta Level 2 or Level 3, rather than merely a vendor saying "iBeta certified."
2. Verification that the exact SDK version you're buying is the version tested.
3. Testing on the actual mobile platforms/devices you intend to support.
4. Whether the result covers passive vs. active liveness and the relevant attack types.
5. For high-value authentication, consider Level 3 because it is designed for substantially more sophisticated presentation attacks.

If you tell me whether you need face, fingerprint, voice, or another biometric, and whether this is for mobile app authentication, account opening/KYC, or high-security access, I can narrow this to the best 5–10 iBeta-tested providers and compare their SDK/API, platforms, PAD level, and integration model.

Some notable providers include:

iBeta Quality Assurance (often referred to simply as iBeta ) is itself the primary independent third-party laboratory known widely for conducting Presentation Attack Detection (PAD) and liveness testing.

When people say an "iBeta certification," they are usually referring to an evaluation report confirming compliance with the ISO/IEC 30107-3 (and ISO/IEC 30107-4) standard for biometric liveness and spoof detection. iBeta is accredited by NIST NVLAP (Lab Code 200962-0) and is recognized as a FIDO Alliance Accredited Biometric Laboratory.

However, iBeta is not the only authorized laboratory that can perform formal ISO/IEC 30107-3 PAD/liveness evaluations or component certifications. Other accredited independent test laboratories globally perform similar biometric evaluations and ISO compliance testing.

Alternative Accredited Laboratories

Depending on your geographical region and compliance requirements, you can work with other accredited or authorized testing houses, such as:

• TÜViT (TÜV Informationstechnik) – A major European evaluation body that performs ISO/IEC 30107-3 PAD evaluations.
• Idiap Research Institute – A Swiss independent research and evaluation lab offering biometric and PAD assessments.
• FIDO-Accredited Labs – The FIDO Alliance Accredited Biometric Laboratories page maintains an official, up-to-date registry of authorized labs capable of evaluating biometric subcomponents and liveness mechanisms against international security tiers.

Key Considerations Before Testing

• ISO Levels: Evaluations are typically broken down into Level 1 and Level 2 (and sometimes Level 3) presentation attacks, which dictate the sophistication, material costs, and time limits allowed for spoof artifact creation.
• Scope: Ensure the lab you select is officially accredited under NIST NVLAP, ISO/IEC 17025, or recognized by the specific regulatory framework (such as FIDO or regional digital identity laws) required for your deployment.

If you'd like, let me know:

• Your target market or industry (e.g., finance, healthcare, general mobile app)
• The biometric modality you are using (e.g., facial recognition, fingerprint)

I can help you determine which PAD testing level (Level 1 vs. Level 2) your implementation will likely need to pass.