Know if the face, voice and document in front of you are real.
XcellSecure checks every video, selfie, voice clip and ID with 8 AI models across vision, audio and physiology. The Trust Factor Engine returns a score from 1 to 10 with reasons, not a bare real-or-fake. The APIs are stateless and run on your premises, so no video is stored or processed in the cloud.
Face-swaps, cloned voices and fake officers on video are now common fraud tools. Indian regulators have responded with advisories, amended rules and stricter KYC checks.
MHA has warned that fraudsters pose as police, CBI, Narcotics, RBI or ED officials, keep victims on Skype or other video calls, and use studios styled as police stations with uniforms to look genuine1.
3,962 Skype IDs and 83,668 WhatsApp accounts used for digital arrests blocked by I4C; 7.81 lakh SIM cards blocked till 28 Feb 20252.
On 7 Nov 2023 MeitY told significant social media intermediaries to identify misinformation and deepfakes and remove reported content within 36 hours3. A second advisory on 26 Dec 2023 asked all intermediaries to tell users clearly what content is prohibited under the IT Rules4.
The IT Rules amendment on synthetically generated information was notified on 10 Feb 2026 and applies from 20 Feb 2026. AI-generated content must be labelled with traceable metadata, and unlawful content must come down within 3 hours of a government or court order5.
CERT-In advisory CIAD-2024-0060 (27 Nov 2024, severity High) asks organisations to add verification protocols with call-backs for sensitive transactions, deploy detection tools and build forensics capability6.
| Rule | What it asks for | Where XcellSecure helps |
|---|---|---|
| RBI KYC DirectionsCommercial Banks – KYC Directions, 2025 (28 Nov 2025), V-CIP | Face liveness and spoof detection, face matching, live GPS geo-tagging on recordings, real-time (not pre-recorded) interaction, V-CIP data stored in India7. | Liveness, Deepfake Detection and DeepFace modules score each V-CIP session; on-prem APIs keep data inside your Indian set-up. |
| SEBI online KYCCircular of 24 Apr 2020 | Online KYC with video in-person verification (VIPV) apps, live audio-visual interaction, and safety features against spoofing8. | Liveness and voice checks during VIPV; trust score attached to the KYC record. |
| IRDAI AML/CFTMaster Guidelines, 1 Aug 2022 | Video Based Identification Process (VBIP) with a liveness check against spoofing, live geo-tagging and recordings with GPS, date and time; third-party or cloud hosting must be in India9. | Liveness for VBIP; claims-video analysis for fraud teams. |
| DPDP Act, 2023Rules notified 13 Nov 2025 | Face images and voice that identify a person are personal data. Notice, consent or another lawful ground, purpose limitation and safeguards; core duties from 13 May 202710. | Stateless processing, no video retention, consent hooks in the SDK, audit log without raw media. |
| CERT-In Directions28 Apr 2022 | Report specified cyber incidents to CERT-In within 6 hours of noticing them11. | Case records from Trust Analytics and FaceOff-Agentic RAG help your incident team act quickly. |
Regulatory summary prepared by XcellHost for orientation, not legal advice. Each regulated entity follows the directions that apply to it; check the current text before relying on it.
Pick what you are checking. The models that apply light up, and the Trust Factor Engine fuses their signals into one score with reasons. Click any stage for detail.
The 8-model mapping shown here describes the signal families XcellSecure covers; the exact model line-up per module and capture type is confirmed during scoping*. Benchmarks on request*.
A binary detector forces a yes or no on every call. A 1–10 trust score lets you approve clean sessions, ask for more proof on the grey ones, and stop the clear fakes. Move the slider.
Most signals are clean, one is weak. Ask for one more proof before you approve.
Illustrative policy. You set the bands per use case; see the simulator below.
Every module returns the same 1–10 trust score and reason codes, so one policy and one audit trail cover all of them.
Helps confirm the person opening or operating an account is real, and flags faces or voices that recur across many accounts, a common mule-account pattern.
Face analysis and matching: compares a live face with an ID photo or an enrolled template and checks it is a live person, not a photo, screen or mask.
Detects face-swaps, re-enactment and fully generated faces in live or recorded video by looking for blending seams, texture and lighting errors and frame-to-frame warps.
Helps verify whether an “officer” on a video call is genuine and flags staged backdrops and synthetic faces, so a bank or helpline can warn the victim before money moves.
Face-based payment authorisation with liveness, so a payment is approved by the account holder’s live face and not a replayed video or photo.
Runs detection across branches or partner entities without pooling raw faces in one place. Models improve from shared learning while media stays where it was captured.
An investigation assistant that answers questions over your verification results, reason codes and policies, and drafts a case summary for analysts and fraud teams.
A lighter build for branches, kiosks and edge devices where bandwidth is low, with core liveness and deepfake checks running on site.
Flags synthetic identities: generated faces, mixed real and fake details, and documents or selfies that look new but share traits with earlier fraud.
Scores recorded or CCTV video for authenticity and tampering, and helps re-identify a person of interest across cameras for investigators.
Module names as supplied by XcellSecure. Detailed specifications, supported formats and the third-party technology behind each module are shared under NDA during scoping — confirm*.
Pick your sector to see the checks that matter and the modules that cover them.
V-CIP sessions need liveness, spoof detection and face matching. Fraud teams also need to spot mule accounts opened by the same face under different names.
Video KYC at policy issuance and video evidence in claims are both targets for synthetic media.
Digital arrest calls rely on fake uniforms, staged police-station backdrops and synthetic faces. Cyber cells also review large volumes of recorded video.
SIM issue at stores and through apps is a starting point for fraud. Store devices often have limited bandwidth.
Remote interviews can be taken by a stand-in or a face-swapped candidate. Joining-day checks then miss the switch.
Editors need a fast, explainable check before they publish or debunk a viral clip, and IT Rules now expect labels on synthetic content.
Face-based payments and seller onboarding need the face to be live and present, not a replay.
CEO-fraud now arrives as a video call with a familiar face asking finance to move money today.
XcellSecure APIs are stateless and on premise: media is analysed in memory and only the score, reasons and a hash come back. No video is stored or processed in the cloud.
Containers in your data centre behind your firewall. Your apps call a REST endpoint; nothing leaves your network.
Default per brochureA dedicated, single-tenant stack run by XcellHost in its Tier IV data centre in Mumbai, still stateless and with no media retention*.
Managed by XcellHost*Federated FaceOff runs at each branch or entity. Only model updates are shared, never faces or voices.
Groups and consortiaFaceOff-Agentic RAG sits on top of your results for investigators: ask a question, get a cited case summary.
Fraud ops · SOCFaceOff Lite on kiosks, branch PCs and tablets for low-bandwidth sites, syncing scores only.
Branches · storesSend a capture reference and the modules to run. The response carries the score, band, reason codes and a media hash for your audit log.
POST https://<your-on-prem-host>/v1/verify // placeholder*
Content-Type: application/json
{
"session_id": "vcip-2026-11-12-00418",
"capture": { "type": "video", "source": "stream://kyc-desk-03" },
"modules": ["deepface", "deepfake_detection", "liveness"],
"consent_ref": "CNS-7F3A-2291",
"purpose": "account_opening",
"policy": "bank_vcip_balanced"
}{
"session_id": "vcip-2026-11-12-00418",
"trust_score": 8,
"band": "allow",
"models_run": 8,
"signals": {
"vision": { "liveness": "pass", "texture": "consistent", "lip_sync": "aligned" },
"audio": { "voice_clone": "not_detected", "replay": "not_detected" },
"physiology": { "pulse_signal": "present", "blink": "natural" }
},
"reasons": ["LIVE_FACE", "NO_BLEND_SEAM", "ID_MATCH_CONSISTENT"],
"media_sha256": "9c1e…a47b",
"stored_media": false
}Illustrative only. Endpoint, field names and module keys are placeholders* to confirm in the integration guide.
Under the DPDP Act, 2023 a face or voice that identifies someone is personal data. XcellSecure is built to collect less, keep nothing and show its work.
Stateless APIs analyse in memory. Only the score, reason codes and a hash are returned.
Every call carries a consent reference and a stated purpose, ready for your consent manager.
A KYC score is tagged for KYC. Policies block reuse of results for other purposes*.
On-prem by default; private-cloud option in XcellHost’s Mumbai data centre.
Reason codes let a reviewer tell a customer why a check failed and offer another route.
Grey scores route to a human, not an auto-reject, in line with RBI’s rule that liveness must not exclude persons with special needs.
Choose a use case and how much risk you accept. The simulator moves the band thresholds and estimates what happens to a month of sessions.
Assumes an illustrative score spread for the use case and 4 minutes per manual review*. Not a measured result.
Tick what is happening on the call. The signs below follow the pattern the Ministry of Home Affairs has warned about. Share this with family and staff.
If even one sign fits, slow down and verify on your own.
Awareness aid by XcellHost based on MHA public advisories; not an official government tool. Helpline 1930 and cybercrime.gov.in are the official channels.
Answer for your first use case. We suggest a package, a deployment mode and the modules to start with.
Every package uses the same 8 models, Trust Factor Engine and stateless APIs. Packages differ by volume, modules and where it runs.
| Add-on | Price | Basis |
|---|---|---|
| Verification pack (10,000) | ₹29,999* | per pack · Professional |
| Extra module | ₹9,999* | per module / month · beyond the 3 included |
| Integration & onboarding | ₹74,999* | one-time · API hook-up, policy bands, staff runbook |
| Deepfake & digital-arrest awareness workshop | ₹24,999* | per session · staff or customers, online or on site |
* Indicative — confirm with XcellHost. All prices, included volumes and module counts are placeholders set for this page. All prices excl. 18% GST. Server hardware for on-prem is not included.
Pick a package, the term and any extras. Enterprise is quoted separately and not added here.
Professional: 10,000 verifications a month included*.
It checks whether a face, voice, video or ID in front of you is real, live and belongs to the person claiming it. XcellSecure combines deepfake detection, liveness, voice-clone checks and document matching, and returns one trust score from 1 to 10 with reasons.
Most detectors answer real or fake. The Trust Factor Engine weighs signals from 8 AI models across vision, audio and physiology and gives a graded score from 1 to 10. That lets you approve clear sessions, ask for more proof on grey ones and block clear fakes, instead of forcing a yes or no.
The models span three families: vision (face liveness, texture and generation artifacts, lip-sync), audio (voice cloning and replay) and physiology (pulse signal from skin colour changes, micro-expressions and blink patterns). The exact line-up per module is confirmed during scoping.
No. XcellSecure APIs are stateless and run on premise. Media is analysed in memory and dropped; only the score, reason codes and a hash are returned for your audit log. No video data is stored or processed in the cloud.
RBI's KYC directions ask V-CIP applications for face liveness and spoof detection, face matching, live GPS geo-tagging and India-located storage of V-CIP data. XcellSecure supplies the liveness, spoof and face-match signals, and its on-prem APIs keep data in your Indian set-up. Geo-tagging and recording stay with your V-CIP platform.
Faces and voices that identify someone are personal data. The design helps you meet the Act's duties with no media retention, a consent reference and purpose on every call, and reason codes you can explain. The DPDP Rules were notified on 13 Nov 2025 and the core duties apply from 13 May 2027.
Digital Arrest: FaceGuard helps verify whether a person posing as an officer on a video call is genuine and flags synthetic faces and staged settings. Banks, helplines and police cyber cells can use it to warn a victim before money moves. Anyone on such a call should hang up and call 1930 or report at cybercrime.gov.in.
We do not publish a single accuracy figure, because results depend on cameras, networks and attack types. Benchmarks are available on request, and the pilot measures results on your own traffic. Standards we test against, such as ISO/IEC 30107-3 for presentation attack detection, are to be confirmed with XcellHost.
Yes. FaceOff Lite runs core liveness and deepfake checks on site at branches, kiosks and tablets, and syncs only scores when a connection is available.
A pilot runs for 30 days on up to 3 modules and up to 5,000 verifications. At the end you get a results report and policy bands tuned to your traffic. Timelines and limits are indicative and confirmed when we scope.
Indicatively ₹1,49,999 one-time for a 30-day pilot and ₹49,999 a month for Professional with 10,000 verifications included. Extra packs are ₹29,999 per 10,000 and extra modules ₹9,999 a month. Enterprise on-prem is quoted. All prices exclude 18% GST and are to be confirmed with XcellHost.
Call +91 22 6711 1555, WhatsApp +91 86570 32540 or e-mail [email protected] for a demo or pilot. Our NOC and SOC run 24×7 from Mumbai; support is at [email protected].
Secure cloud services for your online business since 1999: reliable, secure, fast, scalable, manageable and compliant. A pilot on your own sessions, results report and INR quote.*