Media & Evidence package

Identity document capture (KYC) with redaction for storage

Customers upload an ID photo and a selfie: the document is read, checked by rules, the number blacked out for storage, and a person compares the photos and decides.

Connects to Google Gemini

OfficialStarts from a formIntermediate~20 min setupv1.0.0
Download .utpkg 16 KBHow to install

About this package

What it does

Identity document capture starts from a form page where the customer enters their name and date of birth, picks the document type and uploads a photo of the ID and a selfie (the phone camera opens).

Analyze Image reads the printed fields (name, date of birth, document number, expiry, issuing region) and returns face boxes; the selfie is checked for exactly one face. There is no face recognition or face matching anywhere in this package: the automated checks only compare the text with the form (a Regex step for the number format, conditions for name and date of birth) and the ID document checks decision table turns them into a result and a flag for the reviewer.

Redact Image blacks out the ID number on a copy of the document for storage. The reviewer sees the extracted fields next to the form, opens the original photos (restricted to the review) and compares the selfie with the ID photo themselves, then verifies, asks for new documents or rejects. Only the masked fields and the redacted copy go into the Verified identities table, with a retention policy.

Starts from a form

Starts from a form page: send customers the Verify your identity form (/f/<id>) during onboarding.

Someone fills in a form to start it: the workflow start form (Run dialog in the app, or your own portal posting to the API) or a standalone form page (/f/<id>) whose Form submitted trigger starts the workflow. People complete User Task forms along the way.

How forms work

The flow

Step by step

  1. 1

    ID photo and selfie

    The customer fills in the themed form and uploads both photos.

  2. 2

    Read the document

    Analyze Image extracts the printed fields and face boxes; the selfie is checked for one face. No face recognition.

  3. 3

    Rule checks

    A Regex checks the number format, conditions compare name and date of birth with the form, and the ID document checks decision table sets the result and a flag.

  4. 4

    Redact for storage

    Redact Image blacks out the document number on a copy; the number is kept masked to its last four characters.

  5. 5

    Human review

    The reviewer compares the selfie with the ID photo themselves and verifies, requests new documents or rejects.

  6. 6

    Keep only what is needed

    Verified identities stores the masked fields and the redacted copy under a retention policy; the customer is emailed.

Identity document check — An ID photo and a selfie from the form: the document is read (text and face boxes, no face recognition), checked against the form by rules, the ID number is blacked out for storage and a reviewer compares the photos and decides. The same canvas you get in the designer after installing.

Forms

The start form and the task forms

People start it from a form page (/f/<id>) with its own header, theme and buttons; submitting it starts the workflow. User Tasks show their fields and outcome buttons to the assignee.

Form page · /f/<id>

Verify your identity

3-column grid · own header and theme · Its own page: share the link or open it on a tablet

Full name (as on your ID) * full_name · text
Date of birth * date_of_birth · dateYYYY-MM-DD
Email * email · emailname@company.com
Document * document_type · choice
Driver licensePassportNational ID card
Photo of your ID (front) * id_photo · attachments
A selfie * selfie · attachments
I agree that my ID and selfie are processed to verify my identity, and that a redacted copy is kept * consent · boolean
Submit for verification

User Task

Review the identity

KYC {{kyc_ref}}: {{result}} ({{form.full_name}}) · 2-column grid · own header and theme

I compared the selfie with the ID photo myself * faces_compared · boolean
Message to the customer (for a new request or rejection) message · textarea
VerifiedRequest new documentsReject

From your code

Start a run over the API

Every workflow can be started over REST, MCP or the CLI, whatever its trigger, with the sample input below. Runs start straight away on the published version; replace <workflow id> with the id the install created.

REST

shell
curl -X POST "$USERTASKS_URL/api/v1/workflows/start" \
  -H "Authorization: Bearer $USERTASKS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"workflow_id":"<workflow id>","variables":{"full_name":"Alex Sample","date_of_birth":"1980-07-04","email":"alex.sample@example.com","document_type":"Driver license","consent":true}}'

CLI

shell
usertasks workflows inputs <workflow id>          # the start form: keys, types, required
usertasks workflows run <workflow id> --input full_name="Alex Sample" --input date_of_birth=1980-07-04 --input email=alex.sample@example.com --input document_type="Driver license" … --wait

What's included

9 assets, ready to adapt

TypeNameDetails
Email templateIdentity not verifiedSent when the reviewer rejects the verification.
Email templateIdentity verifiedSent when the reviewer verifies the identity.
Email templateNew documents neededSent when the reviewer needs new photos.
Data tableVerified identitiesWhat is kept after verification: extracted fields with the document number masked, and a redacted copy of the document. The original photos are not copied here.
IntegrationGoogle Gemini (media AI)Media AI provider for transcription, image and video analysis and finding what to redact. Paste your Gemini API key on install (aistudio.google.com). To use OpenAI, Azure AI or AWS instead, point the media steps at that integration.
Decision tableID document checks8 rules — What the reviewer is told before they decide: the automated checks only flag; a person compares the selfie with the ID photo and decides.
Retention policyVerified identities: 5 yearsIdentity records are kept five years after the relationship ends, then reviewed. Set this to your AML / KYC record-keeping rule.
formsVerify your identityCustomers upload a photo of their ID and a selfie; the document is read, checked and redacted for storage, and a person decides.
WorkflowIdentity document check25 steps — An ID photo and a selfie from the form: the document is read (text and face boxes, no face recognition), checked against the form by rules, the ID number is blacked out for storage and a reviewer compares the photos and decides.

Verified identities · 1 sample rows

ReferenceNameEmailDate of birthDocumentNumber (masked)ExpiresIssued byRedacted copyResultDecided byDecided

Requirements

What you connect it to

Credentials never travel in a package. The install wizard asks for what your environment must provide, or installs it incomplete until you finish setup.

Needs

  • Media AI provider — An API key for a media AI provider (Google Gemini by default; OpenAI, Azure AI, AWS and others can be swapped in) that transcribes, analyses and finds what to redact.
  • Assignees — People in your workspace to receive the User Tasks (picked on install).
  • Email — Email delivery configured for the instance (EMAIL_PROVIDER), used for notifications.

After installing

  1. Google Gemini (media AI): paste your Gemini API key. It reads the document text and finds face and text boxes; it never identifies or matches faces.
  2. Assignees: pick the KYC reviewer.
  3. Adjust the ID document checks and the Regex pattern to the documents you accept; set the "Verified identities: 5 years" retention policy to your record-keeping rule.
  4. Original uploads stay as restricted form attachments: purge them on your schedule (form files retention) once the review is done.

Asked for on install

  • Integration “Google Gemini (media AI)”Required

    • Key valueconfig.auth_config.key_value
    • Base urlconfig.base_urldefault https://generativelanguage.googleapis.com· optional

  • Workflow “Identity document check” assigneesRequired

    • User for step “Review the identity”nodes.16.config.assignee_id

Install

Install it in your workspace

Works on UserTasks cloud and on any self-hosted instance. Installing creates the assets above; nothing runs until you complete setup and start it.

In the app

  1. Download kyc-id-document-redaction-1.0.0.utpkg.
  2. Open Automations → Packages and drag the file onto the page (or choose Import package). Browse gallery there lists every gallery package without downloading by hand.
  3. Pick the file. The wizard verifies the checksum, every file hash and the signature, and shows the readme.
  4. Review the changes (what is created) and the data rows.
  5. Fill in the requirements, or tick Keep incomplete and finish later with Complete setup.
  6. Done: the workflow is published and active once setup is complete.

With the CLI

shell
curl -fLO https://usertasks.com/gallery/kyc-id-document-redaction-1.0.0.utpkg
usertasks packages inspect kyc-id-document-redaction-1.0.0.utpkg       # offline: checksum, hashes, signature
usertasks packages install kyc-id-document-redaction-1.0.0.utpkg --dry-run
usertasks packages install kyc-id-document-redaction-1.0.0.utpkg       # prompts for each requirement
usertasks packages install kyc-id-document-redaction-1.0.0.utpkg --keep-incomplete --yes   # in CI; finish with:
usertasks packages complete kyc-id-document-redaction -f values.yaml

Verify the download

File SHA-256
17d5713327dd5d814df4d181f57f8de51789c3398a867d352cc4b2bbb39c293b
Package checksum (what is signed)
sha256:c3261ff95a085e19f0b89e93fb5cac61b3c945bbefc3facf314ca1dbab2e6d6a
Signer
UserTasks Gallery · 49:f3:04:90:47:02:4d:07:28:61:3d:dc:bb:aa:db:11

shasum -a 256 kyc-id-document-redaction-1.0.0.utpkg should print the file SHA-256. How gallery packages are signed.

Versions

Version 1.0.0

  1. v1.0.02026-10-30First release.

Installing a newer version upgrades in place: local credentials and requirement values are kept, and changes you made are flagged first. How packages work

More packages

Related

Browse the whole gallery