- SC2labs assessed OCR Studio’s Android, iOS and WebAssembly-based ID scanning technologies.
- Testing found no requirement for network communication or transmission of personal data beyond the device.
- The assessment identified no security vulnerabilities in the tested software development kits.
The assessment, conducted by cybersecurity auditor SC2labs between 24 August and 14 September 2026, covered SDKs for Android and iOS applications, as well as WebAssembly-based technology for scanning identity documents in web browsers.
Auditors tested the solutions on physical Android and iPhone devices and in virtualised containers. They monitored network traffic while the software processed document images, corrupted or tampered files and random binary data.
According to OCR Studio, the assessment confirmed that network communication was neither required nor used for ID scanning, and that document images and sensitive data were not transmitted beyond the device.
The evaluation identified no security vulnerabilities in the tested SDKs and reported no findings affecting confidentiality, integrity, availability, authentication, authorisation or accountability. The review followed recognised security methodologies, including OWASP Application Security Verification Standard (ASVS), OWASP Mobile Application Security Verification Standard (MASVS) and the Open Source Security Testing Methodology Manual (OSSTMM).
Konstantin Bulatov, Chief Technology Officer at OCR Studio, said “As concerns about personal data breaches grow, businesses are increasingly looking for fully local alternatives to cloud-based ID scanning. For government agencies, banks, fintech companies, telecom providers, and other organisations that want to keep identity data under their own control, independent certification of local operation should become an important criterion when choosing a technology provider.”
