Checks that help.
A person decides.
Each member proves who they are once, on the PollGuard Android app or at a station tablet, with their own identity document and a live selfie. Software reads, checks and scores what the camera sees. Then a named reviewer for the organisation approves or declines every member. Borderline matches get the closest look; a clear mismatch fails, and the member can try again.
LIVE FACE0000000<0KEN<<<
Four checks, in the order a member meets them
It happens once, in one sitting. Each check looks at something different and none is decisive alone: together they catch the obvious problems (a blurred document, a photo held up to the camera, a face that does not match) and give the reviewer the evidence to decide.
- Step 1 of 4SamplePhotograph your ID✓ Edges✓ No glare✓ Not a screenNameACHIENG SAMPLEDocument no.0000 0000ExpiryIn dateThese are rightCheck 01 · the document
A clear photo, read and checked
The camera guides the member to a clear, glare-free picture. The service reads the text, validates the machine-readable lines where the document has them, and looks for signs the image was edited.
- Guided capture. Edges, glare and the stripes a screen leaves, checked frame by frame.
- Text reading. Tesseract, set up for English and Swahili. An outside AI reader helps when it cannot read confidently.
- Check digits. Validated against ICAO 9303 on documents with a machine-readable zone.
- Signs of editing. Error-level analysis, the image’s metadata and the expiry date.
- The back of the ID. Its faint second photo is enhanced and set beside the others for the reviewer.
Flags, not verdicts. It can stop an unreadable or expired document; it cannot prove one is genuine.
More on document checks - Step 2 of 4SampleHold it beside your faceMatching frames12 / 12Taken live in the app. A photo from the gallery cannot be used.Photo takenCheck 02 · selfie with the document
The person and the document, together
The member holds the document beside their face. Before the photo is taken, the software finds both faces, the live one and the one printed on the card, and checks they look alike, frame after frame.
- Find both faces. The live face, the card’s outline, then the smaller face printed on it.
- Compare them live. Both become face templates, made by the same model as the face match.
- Wait for a steady run. Taken only after 12 matching frames in a row. One lucky frame is not enough.
- A second opinion. An outside AI review service looks at the selfie and can ask for a retake.
Why it is there. It ties the person to the document at the same moment. It does not decide the face match.
More on the selfie step - Step 3 of 4SampleTurn your head leftBlink✓ doneSmile✓ doneTurn left● nowPROMPT 3 OF 3Check 03 · liveness prompts
A person, not a photo
Blink, smile, turn your head. A printed photo or a picture on another screen cannot follow the prompts, so the easiest kind of cheating gets much harder.
- Movement. A face that never moves between frames counts against the session.
- The prompts. Eye and smile detectors and a head-turn estimate check each one was carried out.
- Image texture. Rules look for the marks print or a screen leaves. They are logged, not allowed to block on their own.
- A liveness score. The results combine into one score. A session with no liveness result goes to a reviewer.
Said plainly. It raises the bar; it is not a wall. Hand-written rules, not a trained deepfake detector.
More on liveness prompts - Step 4 of 4SampleIs it the same face?DocumentLive selfie00.300.421Clear matchUnder review until a reviewer decidesEvery verification shows “Under review” until a named reviewer approves or declines it.DoneCheck 04 · face match
Is it the same face?
The live selfie is compared with the document’s photo and given a similarity score. The comparison runs on PollGuard’s verification service, not on the phone.
- Find. A standard face detector (OpenCV’s ResNet-SSD) finds and crops each face.
- Describe. ArcFace ResNet-100, a widely used open model we have not retrained, turns each face into 512 numbers.
- Compare. Cosine similarity: the closer to 1, the more alike the faces look to the model.
- Sort. The score is set against fixed cut-offs, shown in the next section.
Two photos the member gave. It searches no outside database and no government register.
More on the face match
Three bands.
A person decides every one.
The face match score sorts the case. The document flags and the liveness result travel with it, so whoever looks at a case sees what the software saw. Software never approves a member, and never guesses a borderline case either way.
The two faces look alike to the model, clear of the uncertain band.
Then the member can vote. The verification, its scores and its flags are kept for the record.
Or no face was found in a photo, or the session has no liveness result. A missing face is never read as a match or a mismatch.
Either way under the reviewer’s own name, kept with the verification.
The faces do not look alike to the model, clear of the uncertain band.
The member can try again from step 1.
Cut-offs, not accuracy. These are the thresholds in the verification pipeline as at 17 Oct 2026, set on 13 Oct 2026. They can change, and this page will change with them. They say what happens to a score; they do not say how often the model is right. That we have not measured on real conditions, so we publish no accuracy figure. How the face match works
What a reviewer sees
Reviewers are people the organisation names. Every case reaches them with everything the software saw, laid out side by side, so the decision is theirs and they can explain it afterwards.
- ImagesFront and back of the document, as captured
- The selfiesThe live selfie, and the one with the document
- TextThe fields read, and whether the AI reader helped
- Check digitsPass or fail, where there is a machine-readable zone
- Editing signsThe flags raised, and the expiry date
- ScoresFace match and liveness, with the prompts
DOCUMENT · FRONTBACK · ENHANCEDLIVE SELFIE
Daudi SampleOn the roll · no phone with himEligibleAn officer can help.
Their name goes on it.
Members without a phone, or whose phone cannot run the app, verify on the station tablet. A returning officer guides them through the same four checks, on the same camera-first flow.
- A.1Same checks, same scoringThe tablet captures; the verification service checks and scores it the same way as for the app.
- A.2Named every timeThe assisting officer’s name is recorded with each verification they help with, and the tablet keeps the station’s count of assists.
- A.3A reviewer still decidesAn assisted case waits for a named reviewer, like any other.
- A.4Then the ballot, at the same tabletThe officer sees who has voted, never how.
Verified once.
Re-checked before casting.
Verification happens once. On voting day, before the ballot is cast, the app asks for a quick confirmation that it is still the verified member holding the phone, in one of two ways.
Your choice is ready1 position| Face re-check | Phone biometric | |
|---|---|---|
| Compared with | The face verified earlier, from the template kept with the verification | The fingerprint or face enrolled on that phone |
| Who checks | PollGuard, against the member’s verified face | The phone itself; the app is told only whether it passed |
| What it shows | The person voting looks like the verified member | The person holding the phone can unlock it |
| Then | The ballot is cast and a receipt comes back for each position. | |
On our servers.
With some outside help.
The phone or tablet captures the photos and runs the prompts. The checks run on PollGuard’s own verification service. Two steps use an outside AI service, and we would rather say so here than in small print.
The phone or station tablet
Guides the camera, runs the prompts and takes the photos. It does not decide anything.
Sends over HTTPSPollGuard’s verification service
- Face detection and the face match
- Document capture checks and check digits
- Text reading
- Liveness scoring
An outside AI document reader
When our text reader cannot read a document clearly, it helps read it. The same service gives a second opinion on the document and the selfie, so those images are sent to it.
With 2, when neededWhat is kept with a verification
Retention and deletion. How long each is kept, and how to ask for it to be deleted, is set out in the data protection notice, under Kenya’s Data Protection Act 2019. Members’ data belongs to the organisation.
Said plainly. Backups run nightly, but identity-document images are not yet in the backup.
The parts, by name
- Face detector
- OpenCV’s ResNet-SSD model
- Face template
- ArcFace ResNet-100, 512 numbers; a widely used open model, not retrained
- Text reader
- Tesseract, set up for English and Swahili
- Check digits
- ICAO 9303, where the document has a machine-readable zone
- Liveness
- Eye and smile detectors, a head-turn estimate, hand-written image rules
- Outside help
- An AI document-reading service, for hard text and a second opinion
What we do not claim
Each check raises the effort needed to cheat. None makes it impossible. If you read any of these about PollGuard elsewhere, it was not from us.
An accuracy percentage
We publish none. We have not measured one on real conditions that we would stand behind.
A government register lookup
No check against IPRS or any government database. Eligibility comes from your organisation’s own roll.
A model trained on our members
The face match uses a widely used open model. We have not retrained it.
That it cannot be fooled
A good forgery or a well-made video could get further. That is why a person decides every member.
That it all runs on the phone
The checks run on our verification service, with an outside AI document reader assisting.
Deepfake detection
The liveness image checks are hand-written rules for photos and screens, not a trained detector.
Face-recognition models can perform differently across groups of people. We have not yet measured how this one performs for PollGuard’s members. It is one more reason a named reviewer decides every member, and why we publish no accuracy figure.
Questions members and boards ask
Do you check my ID against IPRS?
No. No government register is consulted. Whether you may vote comes from your organisation’s own roll.
Can I use a photo from my gallery?
No. The selfie is taken live in the app or on the station tablet, with the prompts running.
My match was borderline. What now?
It waits in the review queue for a reviewer your organisation has named. They see the photos, scores and flags, and decide.
I was declined. Can I try again?
Yes. Start again from the document. Good light and a clean, flat document help. A station officer can assist.
I don’t have an Android phone.
Verify and vote on a station tablet, with an officer to help. There is no iPhone app, and no voting by SMS or web browser.
Is my face stored?
The selfie and a numeric face template are kept with the verification, with the document images and check results. Retention follows the data protection notice.
Can a reviewer see how I voted?
No. Officers and reviewers see who has voted, never how. The receipt check never returns a choice either.
Who are the reviewers?
People your organisation appoints. Each decision carries the reviewer’s name, and their note if they add one. PollGuard does not decide for you.
What does verification cost the organisation?
KES 25 per voter, per election, with a minimum of 200, from the live price list on 17 Oct 2026. Prices exclude VAT. See pricing
Ask us how it handles your roll.
Bring your questions to a briefing: review queues, officer assists, data protection, and what happens when a check is unsure.