T

Thirdfort

The AI is real and vendor-claimed but it powers one product of five. Thirdfort sells identity verification, document verification, PEPs and sanctions screening, source of funds and know-your-business checks. Only document verification carries an AI claim, and it carries a clear one: a section headed An AI for detail, stating that artificial intelligence inspects every upload for signs of tampering, forgery and counterfeiting across visual, data and metadata elements, repeated in the FAQ in the first person as our AI.

The flagship identity check makes no AI claim at all: its published mechanisms are cryptographic reading of the signing keys in an e-passport NFC chip and address matching against Experian data. The remaining products are screening and registry lookups against ComplyAdvantage, Dun and Bradstreet and Kyckr sources. Remove the models and four of the five checks are unaffected while document verification loses its detection engine.

That restraint is itself evidence the claim is meant literally rather than decoratively, but it places the machine learning as a component of one module rather than the mechanism a buyer is paying for across the platform.

Grounding is real, documented and verifiable, and there is a contractual accuracy undertaking, but nothing measures the result. Every identity document is checked against the Metropolitan Police's Amberhill database of documents reported lost or stolen, an outside authoritative source a buyer can name. The identity check validates the cryptographic signing keys inside an electronic passport chip rather than inferring from an image, and reference data is attributed to named suppliers with published terms.

Clause 6.1(b) of the Terms commits Thirdfort to use all commercially reasonable endeavors to ensure Reports are accurate and complete in all material respects. The app blocks blurry, cropped or oversized uploads before they reach the model. Measurement is absent. For a forgery detection product the natural figures are a detection rate and a false positive rate, and neither is published, nor any test set, evaluation or named failure mode.

Thirdfort warrants report accuracy in its own terms while the supplier terms it passes through disclaim it: Experian accepts no liability for any failure to achieve a particular result, and Kyckr disclaims any warranty of accuracy, completeness or reliability.

The route back to human judgment is contractual rather than advisory. Clause 8 says the Reports must not be the sole basis of business decisions, that the firm is solely responsible for its conclusions, and that Thirdfort gives no opinion and makes no recommendation on how to treat results. The supplier terms repeat this, with ComplyAdvantage saying results must not be used to draw any automatic conclusion or be relied on in isolation about anyone flagged or not flagged.

A review surface stands behind the words. The report shows flags in three states, for what has passed, what is not relevant and what needs consideration, and the last routes the decision to a person. The uploaded document is stored with the report, so a reviewer can check the model's input against its output. The internal control structure is missing. No threshold is published at which the system flags rather than passes, no confidence signal is described as visible to the reviewer, and nothing says what happens when a forgery is missed or a genuine document is wrongly flagged.

There is real deployment evidence at scale, without measurement that can be assessed. More than 1,500 regulated businesses are said to use the platform, and named customers are quoted rather than shown only as logos. Boyce Hatton speaks on meeting HM Land Registry's Digital ID Standard, Thomas Legal on client completion times as a competitive edge, and Mezzle on the client experience. Direction Law says it set a target of a 50 percent faster compliance process and believes it exceeded it.

Operational figures are specific: 75 percent of people complete their checks within 24 hours, documents are verified from 195 jurisdictions, electronic address verification covers 17, and reports return in minutes. The figures carry no method, sample, baseline or date, and the strongest is a customer's own belief about its target. None of the outcome evidence is attributed to the AI. The completion and speed claims describe the app and the check workflow, so a buyer assessing forgery detection has adoption evidence for the platform and none for the model.

Published commitments are substantial across most areas, and privilege is not among them. The Terms of Use set mutual confidentiality with access on a need to know basis, a 30 day obligation to destroy or return on request, and liability for the acts of permitted recipients. Clause 12.1 leaves the firm owning its data, and clause 12.3 licenses it to Thirdfort only as needed to provide the Services. The data processing agreement makes the firm the controller and Thirdfort the processor, limits processing to the firm's instructions and restricts access to staff who need it.

Security measures are specific: AES-256 or stronger at rest, TLS 1.2 or better in transit, two factor authentication for users, least privilege and device encryption for staff, no storage on local machines, and documented separation of data between customers. All initiation and report data is deleted within 30 days of a written request, with the fields listed. Privilege and work product appear nowhere. That costs a buyer less here than on a product facing matters, because Thirdfort holds identity and source of funds material rather than privileged case files.

Responsibility is allocated in the agreement, but no professional conduct framework is engaged. Clause 8 makes the allocation squarely. The Reports help a firm understand risk and meet its compliance obligations, they must not be the sole basis of a decision, the firm is solely responsible for its conclusions, and Thirdfort gives no opinion or recommendation. Appendix 1 contains wording the firm must send its client before lite screening and identity document verification, framing the check as part of the professional's own due diligence rather than advice from Thirdfort.

Professional conduct itself is not addressed. Nothing engages unauthorized practice, nothing names a conduct rule or regulatory obligation that the firm's use of the product touches, and the estate contains no statement on professional responsibility. The platform never advises a client or produces legal work product, so several professional responsibility questions do not arise.

No governance disclosure is published in a legal estate that is otherwise thorough. There is no AI policy, responsible AI or ethics statement, governance framework, ISO 42001 or NIST AI RMF alignment, named internal owner for AI decisions, or description of model evaluation or testing. The Terms of Use, data processing agreement and security measures page have no provision specific to AI. The gap matters here. The security measures page says Thirdfort processes personal data including biometric information, and the product applies automated document and identity checks to people whose onboarding depends on the result.

Uneven performance across demographic groups is a well documented property of biometric and document image systems, and nothing published addresses fairness, differences in error rates, testing across populations, or what recourse a person has if a check wrongly flags them. The ISO/IEC 27001:2022 certification covers information security, not this. Surfaces read: both product pages that carry AI, the security measures page, the Terms of Use, the data processing agreement, the third party products and terms, the terms index and the pricing page.

Stewardship is documented at contract level and is tight, though none of it is specific to AI. Processing is purpose limited twice: clause 12.3 of the Terms licenses client data only as needed to provide the Services, and clause 2.4(a) of the data processing agreement limits processing to the Services on the firm's instructions. No training or model improvement right is reserved anywhere. The perpetual feedback license in clause 12.4 expressly excludes personal data.

Deletion is concrete, within 30 days, with the fields listed. Security measures are specific: annual penetration testing commissioned by the vendor, routine vulnerability scanning, security log monitoring, encryption at rest and in transit, and architectural separation between customers. Breach notification runs without undue delay under the processing agreement, and FCA licensing requires quarterly reports on operational and security risks, which is outside supervision rather than self assertion.

Nothing addresses the AI specifically: how document images and biometric material are handled by the model, how long the model's inputs and outputs persist, or whether anything is kept from an inspection once the report is produced.

Quantified recourse exists, and the exposure that matters for AI is routed away from it. The Terms of Use cap liability at the higher of 25,000 pounds or the fees paid in the previous twelve months, with data protection breaches carved out and capped separately at 2.5 million pounds in aggregate. Clause 6.1(b) warrants that Reports will be materially accurate and complete, intellectual property indemnities run both ways, uptime is committed at 99.5 percent monthly, and material breach carries a 30 day cure.

Clause 16.2(b) lets a firm terminate immediately if an update materially reduces the service and no substitute follows, and clause 18 gives an annual audit right. Three provisions cut the other way. Clause 9.3(g) excludes losses caused by Third Party Products, which is where the suppliers' parts of the checks sit. Clause 9.4 waives the firm's claims arising from the Platform, Services or Reports in connection with services the firm provides to its own client, the very scenario a firm relying on a regulated check most needs covered. And uptime is measured from when the customer reports a fault in writing, not from onset.

An integration surface exists and is governed by contract, but no legal practice system is published on the vendor's own pages. Thirdfort publishes a separate API Agreement for clients and partners building a direct integration, incorporated by clause 21 of the Terms of Use. Distribution through partner platforms is central to the model. Clause 2.2(b) contemplates a firm using the services entirely through a partner's platform, clause 19 governs the information exchanged, and a partners list is kept at a published address.

Direction could not be established. No case management, practice management, document management or legal accounting system is named in any page read, so a buyer cannot tell from the vendor's own material which systems the product connects to. The partners list was not opened and may say more.

Tenancy is addressed and region is not. The security measures page says Thirdfort hosts its infrastructure and databases on Google Cloud Platform, with data in managed database services across three data centers at different sites, no storage on local machines, and an architecture that separates data and information security between customers and application components. That is a documented model for separating customers.

Residency is weaker. The three data centers are not located and no residency choice is offered. The vendor says plainly that it uses service providers outside the United Kingdom and European Union, relying on contractual transfer mechanisms rather than keeping data in region. Those mechanisms are properly specified: the data processing agreement incorporates module 2 of the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, with Thirdfort as importer and the firm as exporter.

The completed transfer schedules that would show the destinations are published as images and could not be read, so they may say more. No private deployment option exists, which is expected for a verification service built on a consumer app.

Several current certifications, granted independently, are published without a portal. Thirdfort states it holds ISO/IEC 27001:2022, the current revision, and is certified as an Identity Service Provider under the UK government's Digital Identity and Attributes Trust Framework, run by the Department for Science, Innovation and Technology. It is certified under the UK Digital Verification Services framework and appears on the GOV.

UK register of digital identity services, which a buyer can check independently. FCA licensing adds supervision that works like a certification: in the vendor's account, the regulator has reviewed its security policies, and Thirdfort must file quarterly reports on operational and security risks. Penetration testing is annual and commissioned by the vendor, alongside routine vulnerability scanning and security log monitoring.

No certificate, certificate number or validity period is published, no auditor or certification body is named, there is no SOC 2 report, and there is no trust center. Certifications are available under clause 18.2 on request during an audit, and clause 18.3 excludes access to external reports that are not public.

The supply chain is partly disclosed, and that part is done properly. Six suppliers are named in a published, versioned document that reproduces their full terms: Onfido, Experian, IVXS UK trading as ComplyAdvantage, iProov, Dun and Bradstreet, and Kyckr Ireland. A separate service provider page, dated 24 October 2025, separates data providers from technical providers and offers a subscription to subprocessor notices.

Change is governed by contract. Clause 16.2 of the Terms gives 30 days' notice of any material change to the data provider list with a right to terminate, and clause 3.3 of the processing agreement requires written notice of new subprocessors within 30 days with a right to object. Experian's terms disclose that its services involve models based on statistical analysis, probability and predictive behavior. No model is named, and the vendor never says which supplier, if any, provides the AI behind document verification.

Naming Google Cloud Platform says where the service runs, not whose model inspects a passport. The page mapping features to providers is published as an image, and the provider tables did not render, so both may say more.

Commercial mechanics are published in the contract, and prices are not published anywhere. The pricing page is organized by buyer type, inviting a reader to select an industry to see plans, with a custom quote for industries not listed. The plan detail behind that selector did not render, and the page's own wording says plans are there to be seen, so it may say more. The Terms of Use establish real terms. Fees are agreed separately and exclude VAT, any increase carries 30 days' notice with a chance to stop using the service, and disputed invoices must be raised within 30 days.

Overdue amounts carry interest at 4 percent above the Barclays base rate, suspension follows 7 days' notice, minimum purchase commitments exist and survive early termination, and a discounted trial may be offered at the vendor's discretion. No figure, band or unit of charge appears. The product is bought as checks and plans, and no price per check, seat or plan appears on any page read.

Coverage is deep in one practice area and deliberately narrow beyond it. Legal is one of four named sectors, alongside conveyancing, estate agents and accountants. The insights library has a Lawyers category aimed at solicitors, including guidance on file notes that survive an SRA review and on enhanced due diligence after the 2026 Money Laundering Regulations reforms. Depth is strongest in property: the enhanced NFC identity check is built to HM Land Registry's Safe Harbor standard under Practice Guide 81, and the platform supports corporate service providers meeting the Companies House identity standard.

The checks cover documents from 195 jurisdictions and electronic address verification across 17. The practice surface is a single workflow, client onboarding and anti money laundering diligence, with no other legal practice area and no statement of matter types. The regulatory frame is the United Kingdom's, resting on FCA authorization, HM Land Registry, Companies House, the SRA and English law, so a firm elsewhere sees a product built around another regime. The legal sector page redirected to an insights article and was not read directly.