Why Solidus Pod doesn't gate access with biometrics

Because a biometric answers a question a pod never asks. Pod gates access with Web Access Control, and there is no biometric capability anywhere in its code.

What actually gates access

Three layers, all readable in the code:

• The account, a password, hashed with scrypt, per-user salt, constant-time comparison.
• The session, bound to a key, so a stolen token is not enough on its own.
• The resource, Web Access Control, demonstrated this session with a before-and-after and a control.

No biometric appears at any of the three.

The verification, including the part where our own search lied

A first search for biometric terms matched ten files. Every one of them was the word "face" inside "surface".

A word-boundary search returned three hits, and all three are a user-interface icon named "fingerprint", the picture next to an identity folder. A term that genuinely appears matches six files, so the search is working.

We are publishing the failed search alongside the good one because "we grepped and found nothing" is exactly the kind of claim that deserves the working shown. A substring that crosses a word boundary has produced a wrong answer in this estate before.

The architectural reason, which is the real one

A biometric authenticates a person to a device. Access control authorises an agent to a resource. Those are different questions at different layers, and the standard composition keeps them apart:

your face or finger unlocks the device → the device holds a key → the key authenticates the agent → the rule on the resource decides what that agent may do.

The biometric never leaves the device, and the pod never needs to know it exists. Anything that transmits it has moved a local check onto a network for no gain.

Why sending it further would be worse, specifically for us

• A biometric is an identifier you cannot rotate. A leaked password is replaced in a minute. A leaked face is not replaced. Putting an unrotatable secret behind an access-control layer whose granularity we have already conceded is incomplete is a poor trade.
• A pod holding biometric material becomes a much heavier object. That is special-category personal data, and our compliance position is documented and thin, no impact assessment, no records of processing, no appointed representative.
• In the hosted case we would be the ones holding it. We are already in the processing path; adding this is a promise we are not positioned to make.

It was explored, and this page says so

A 2025 research document in our archive sketches a biometric phase. It predates any shipped code and it is not what pod runs.

A critique kept alongside it argued the approach would not scale. We are not reproducing its specifics: it named a company as a cautionary example, an unverified third-party judgement, and somebody else's difficulty is not an argument for us, and it listed techniques for defeating such systems, which is not something this estate publishes.

The part worth keeping is the conclusion, and it is ours to own: we explored it and did not build it, and the reason on this page is architectural rather than a retreat under criticism.

And the scope statement, because the estate contains the opposite fact

Another Solidus product does process biometric captures. That is a different surface with a different purpose, and the separation is deliberate rather than accidental.

Nothing about that product's capability is a pod capability, and a reader who takes this page as "Solidus does not do biometrics" has read it too broadly. Pod does not. The estate does, elsewhere, under a different set of obligations.