Key takeaways
- Test on your own images — not vendor demos.
- Measure FMR and FNMR at the threshold you'll actually use.
- Check privacy architecture, DPAs and data location early.
- Model total cost with realistic call volumes.
The 10-point checklist
- Accuracy on your data. Collect a representative, consented test set and measure FMR/FNMR.
- Liveness. Which attacks are covered? Any ISO/IEC 30107-3 testing?
- Latency. Measure end-to-end from your region, not just processing time.
- Throughput. Per-minute limits must survive your peaks.
- Pricing clarity. Flat plans or per-call? What happens at the limit?
- Privacy design. Photos or templates? Deletion by API?
- Data location and transfers. Where is data processed? What transfer mechanisms apply?
- Contracts. DPA, sub-processor list, SLA.
- Developer experience. Docs, errors, sandbox, support response.
- Responsible use. Does the vendor refuse harmful uses?
Independent benchmarks
The US National Institute of Standards and Technology runs the Face Recognition Technology Evaluation (FRTE), which compares algorithms across demographics and image types. It's a useful signal, but always confirm on your own data.
Running a pilot
Start on a free tier, build the smallest version of your flow, and run it in shadow mode alongside your current process for two weeks. Compare decisions, not just scores. SIMSIM's free plan gives 250 requests a month for exactly this.
