Verified. Not remembered.
Verlinko anchors a candidate's face at the first interview, then confirms it at every round, on Day One, and at unannounced moments through their tenure. A paired second camera makes deepfakes and hidden AI help physically hard to pull off. No recordings, no documents, no names stored.
One guided capture at the first interview becomes the candidate's only face record. It is never replaced.
Every later round and Day One are checked against that same anchor — never against each other, so drift cannot creep in one acceptable step at a time.
Brief, unannounced checks through tenure confirm the person doing the work is still the person who won the role.
None of this is AI detecting AI — that race the attacker wins. We change the physics, and the economics follow: defeating a camera you don't control, from an angle deepfakes aren't built for, at a moment you weren't told about, costs more than any job pays. The juice is not worth the squeeze.
Companies hiring remotely, where the person interviewed and the person who starts work are confirmed by two different processes — or by none. Background checks verify that an identity is real. They were never designed to verify that the person presenting it is the one it belongs to. That gap is where interview fraud lives, and real-time face and voice synthesis has made it cheap to exploit. Eleven governments said exactly this on 31 July 2026: their joint statement and the FBI's standing guidance warn that state operatives now use real-time deepfakes in live video interviews.
And security teams. The wrong person on Day One is not an HR record. It is an insider with credentials.
A detection problem. It puts you in an arms race against generative models that improve every month and are funded better than you are. Independent testing shows detection accuracy collapsing from laboratory results to near chance on real-world material. Every win is temporary.
A continuity problem. It has a definitive answer, that answer does not degrade as the models improve, and answering it requires holding almost nothing about the person.
Most vendors make policy claims — we delete after 30 days, we're compliant. Those are commitments about future behaviour, resting entirely on trust in the operator. Verlinko's strongest guarantees are properties of the system: breaking one means changing the architecture, and changing the architecture is visible.
The identity record carries a database constraint that rejects any write attempting to retain a raw identity payload. Not a rule staff are asked to follow, or a setting an administrator could change under pressure. The write fails. Verlinko's own application code cannot override it.
What persists is 512 numbers, not an image — and the system holds no name, no email and no identity document. A candidate is an opaque reference only the employer can resolve. We treat that template as regulated biometric data, because it is — encrypted, access-controlled and retention-bound, rather than described as anonymous.
Every continuity check after the first is compared against the original anchor and never written to storage — only the resulting score is kept. Interview twelve times and the system still holds exactly one face record: the first.
Requesting deletion from an identity provider and confirming it happened are different things. Verlinko models purge as a state machine with retry, backoff, terminal-failure states and an attestation record — not a request fired into the dark and marked complete.
A synthetic face injected into a video call is convincing head-on. It is also a flat plane viewed from the side. The candidate's phone, placed off-axis, is a second and independent device the attacker does not control — and it observes from an angle where a two-dimensional reproduction has far less to work with.
Audio coaching — a wireless earpiece, live transcription, an assistant listening on a second device — depends on one thing: the question being spoken aloud. So the interviewer types it instead. It appears only on the candidate's screen, and the answer is spoken.
A matching system is only as good as the distance between its two populations. These are measurements from Verlinko's own pipeline — not a vendor datasheet. Most vendors in this category publish no separation data at all. You can reproduce it on your own face in about a minute.
Each result stores the exact threshold in force when it was made, alongside the model and the alignment method. Tighten the standard next year and last year's decisions remain interpretable on their own terms.
Gate one is the continuity check. Gate two is a live authorised recruiter actively approving. A leaked link on its own gets nowhere: the wrong person fails gate one, and no recruiter is standing by to pass gate two.
Verlinko surfaces signals and confidence. It does not make hiring decisions and holds no mechanism to. Human review is where the decision lives — both the correct design and what regulators increasingly require of anything touching employment.
Round four is not compared to round three. It is compared to the anchor captured at the very first session. Drift cannot accumulate one acceptable step at a time, because there are no intermediate baselines to drift through.
A check at the start of a session only proves who sat down. Verlinko re-verifies against the original anchor at every point where a substitution becomes possible.
The one and only face record, taken at the first session and never replaced.
Confirms no substitution occurred during the document step itself.
Including every subsequent interview round, months apart.
Catches gradual substitution that a single opening check would miss entirely.
Whoever returns is re-verified before monitoring resumes.
A disconnection is a substitution window. It is treated as one.
The person who arrives is checked against the anchor from the first interview — at a stricter threshold.
Brief random re-checks against the original interview anchor. Minutes per quarter, scoped to roles where the wrong person at the keyboard is a security incident. The camera opens, the match runs, only the score is kept, and the moment ends. A check, never a watch.
The day you hired this person, you signed off on who they were. Every day since, you have been trusting that nothing changed. Account handovers, outsourced shifts, and sold credentials all happen after onboarding, in the long quiet stretch no check was ever designed to cover.
Verlinko extends the interview anchor into that stretch. A tenure check is the same comparison the candidate already passed at interview, run again at a random moment, under the same consent, at a stricter threshold. Monitoring tools watch what people do. A tenure check confirms who is present, for a moment, and then stops. No image is taken or kept. A failed match asks for a retry, then routes to a human. It never accuses.
These are not gaps in a roadmap. Each was considered, argued, and rejected in writing — because building it would compromise something worth more than the feature.
Inferring emotional state in a workplace context has been prohibited under the EU AI Act since February 2025. Verlinko does not go near it, and will not.
Searching a face against a database is remote biometric identification, and it is what turns a verification tool into surveillance. Verlinko only ever compares one person to their own earlier self.
Creates precisely the retention liability the product exists to eliminate. Live observation is also faster and more actionable than review after the fact.
Verlinko surfaces signals and confidence. It holds no mechanism to reject a candidate, and a failed check routes to a human, never to an outcome.
An arms race with no durable winner, exited deliberately. Continuity across an entire process is a harder thing to fake than any single frame is to classify.
Knowing who to contact requires storing who they are. Employers send their own messages; Verlinko never learns a candidate's name or address.
No session recording during tenure. No behaviour tracking. No continuous observation. A tenure check is re-attestation, not monitoring, and the difference is architectural: there is nothing running between checks.
Nothing is installed, on a candidate's machine or an employee's. Verlinko is a web page that asks for the camera, runs the check, and closes. Software holding control of every employee laptop is a larger security problem than the one it was bought to answer.
Verlinko runs alongside the video platform already in use — Zoom, Teams, Meet. No change to how interviews are conducted, no integration required to start, and nothing new for candidates to install.