Two identical-twin founders gave away 500 identity verifications a month, raised $7.5M, and turned a market built on sales calls into something a developer can ship before lunch. Here is how the KYC business got a public price tag.
Every developer who has ever wired up identity verification knows the ritual. You find a vendor, you click a button that says "Contact Sales," you wait, you get on a call, you ask about pricing and get a slide deck. Didit skipped all of it. You sign up, you get an API key, and you run 500 real identity checks a month without paying anyone. That is the whole pitch, and it is also the whole strategy.
Didit, part of Y Combinator's Winter 2026 batch, sells one API that handles the unglamorous work of proving people are who they say they are: document verification, face matching, liveness detection, business checks, sanctions screening and transaction monitoring. It runs across 220+ countries and more than 14,000 document types, and it does the core check in under two seconds. The company is based in San Francisco and was founded in 2023.
Didit was built by Alberto and Alejandro Rosas, identical twins from Barcelona who were professional tennis players before they were founders. Alberto runs the company as CEO; Alejandro is CTO and owns the architecture. Their first venture together was Gamium, a Web3 and metaverse project. When that world did not turn into the future everyone promised, they went looking for a problem that would matter no matter which direction the internet went. They landed on identity.
The timing was not an accident. Generative AI made it cheap to fake a face, clone a voice and forge a passable document. Every system that quietly assumed a real human was on the other end suddenly had a hole in it. Didit's argument is that trust now needs its own infrastructure layer, the way payments got Stripe.
The product is modular. A fintech onboarding a new user runs full KYC: scan an ID, check it is real, run a passive liveness test so a photo of a photo does not pass, match the face to the document, and analyze the IP. A marketplace verifying sellers can add business verification (KYB) to confirm the company and its owners exist. A crypto exchange bolts on wallet screening and transaction monitoring to stay onside with regulators. Everything is one API and every endpoint is documented in public.
There is also a smaller feature that hints at where this is going. Didit built a CAPTCHA that replaces "click every square with a traffic light" with a one-second face check. It is a modest product. It is also a preview of a web where proving you are human stops being a chore you fill out and becomes something that just happens in the background.
The first 500 KYC verifications per workspace are free every month, forever. No minimums, no contracts. In a market that usually hides pricing behind a sales team, the number itself is a marketing weapon.
More than 2,000 businesses use Didit: neobanks and fintechs, crypto exchanges, gig and gaming platforms, telcos and traditional banks. Named customers span from a research lab at UCSF Neuroscape to the telecom operator Crnogorski Telekom, shipping marketplace Shiply, and crypto players like Bit2Me and Bondex. Millions of people run through its checks each month.
The detail worth sitting with: roughly 80% of Didit's customers had never bought identity verification before. The free tier did not just win business from incumbents, it pulled in companies who previously did nothing, or hacked something together. Didit did not only take the market. It grew it.
Between November 2024 and July 2025, Spain's financial authorities, the Treasury, the Bank of Spain, the securities regulator CNMV and the financial-crime unit SEPBLAC, ran Didit through a year-long regulatory sandbox. Their conclusion was that Didit's remote verification meets or exceeds the security of checking someone's ID in person. That kind of finding is rare, and it is the sort of credential that turns a cheap API into something a compliance officer can sign off on.
The identity market is not empty. Persona, Onfido, Jumio, Sumsub, Veriff and Socure all sell versions of this. Most of them sell to the legal or compliance department through enterprise contracts, with pricing you have to ask for. Didit aimed one level down, at the engineer who has to integrate the thing at 11pm. Read the docs, copy the snippet, go live in five minutes. The wager is that when you win the builder, the buyer follows, and that transparency itself becomes a moat in an industry allergic to it.
It appears to be working. Didit says it reached profitability by May 2026, unusual for a seed-stage company, and closed its $7.5M round with backing from Y Combinator, Pioneer Fund, Robinhood Ventures, Orange Collective, and angels including Gusto co-founder Tomer London.