Mercle is the third proof-of-human protocol to put its most critical step on the TACEO Network, after World and ZKPassport. The uniqueness check inside its proof-of-human protocol, the step that has to compare a new face against every enrolled one, will run as a secure multiparty computation, so no single operator ever holds readable face data.
Proving you’re a real person shouldn’t mean handing your face to a company. Mercle’s Face Signature is a proof-of-human protocol built on facial biometrics. It confirms a real, live human is present and hasn’t signed up before, on an internet where AI can generate a face, a voice, or a whole persona on demand.
Liveness, whether this is a real, live human and not a deepfake, can be checked locally, on the device. Uniqueness, whether this same human has already registered, can’t. That’s a comparison problem: to know that a given human hasn’t registered before, a system has to check a new face embedding against every template already enrolled, and that is where biometric systems concentrate their risk: the check looks like it needs everyone’s biometrics gathered in one place. That kind of trove is exactly what attackers go looking for. And unlike a password, you can’t reset your face.
The integration: TACEO:Match
Mercle’s uniqueness check will run on the TACEO Network as a secure multiparty computation (MPC), through TACEO:Match. The user’s device secret-shares the face embedding into three pieces, and only those unreadable shares leave, one to each of three independently run nodes. The nodes compare it against the enrolled set in that shared form and agree on a single answer.
So there’s no readable facial-biometric database for anyone to breach. The shares never meet, remain masked, even during computation. Mercle’s privacy promise to its users holds at the one step that has to look across everyone.
How it works, end to end:
- On your device. Your phone turns your face into an embedding and secret-shares it into three pieces. No facial data leaves the device.
- In the network. Three independently run nodes compare their secret share against the enrolled set in that shared form. No node holds readable facial biometric data.
- Back to the app. The result is a decision, not a similarity score: enroll a new unique person, or recognize one already enrolled.
One layer, every modality
This is based on the same MPC matching already protecting World’s iris templates. Each team proves a person is real and unique a different way:
- World: iris biometrics, proof-of-human.
- ZKPassport: a government passport, straight from the NFC chip.
- Mercle: facial biometrics, built for the agentic web, a first use of TACEO:Match.
World ID and ZKPassport run their uniqueness checks via TACEO:OPRF, while Mercle is the first to use TACEO:Match. Different modalities, different TACEO services underneath; one neutral network under all three, whatever chain the app runs on.
Why it matters
Mercle is building proof-of-human credentials for the agentic web, where the guarantee that nobody holds your facial biometrics is what enables adoption at scale. Running the uniqueness check on a network Mercle doesn’t own and can’t read makes that guarantee structural. During matching, the enrolled templates stay secret-shared across the nodes, and no single party can reconstruct a readable one.
For the person holding up their phone, that’s the payoff: you prove you’re a real, singular human, you get recognized once, and no single party ever holds a readable copy of the facial biometrics behind that proof.
Identity today; the same guarantees make private payments and confidential finance possible tomorrow.
Building identity that doesn’t have to hold your users’ data? TACEO’s Identity Solutions
Read more about TACEO:Match: TACEO:Match Docs
