Recently, with the rise in laws requiring age verification to access adult content, there's been a number of companies pop up offering ID verification services, with various degrees of credibility. Most established sites tend to use well-established solutions like ID.me or Idemia. These companies have their own controversies, which I'm not really going to get into here. This is about something worse. There's also been an trend of adult Discord servers using bots for identity verification to shield themselves from liability under legislation that's requiring age verification to access adult materials. Like many things, it seems sensible on the surface.

Ageify

Ageify Bot is a bot used for age verification on Discord servers, and is one I encountered today.

Who is Ageify?

Legal Entities

Ageify Bot is run by a company supposedly called "TC SUS Holding LLC". Or it might be "TCSUS Holding LLC", if you're going off what their Terms of Service page says. They can't really seem to decide on what they're called. The bottom of their site has a phone number, which I have not called, which has an area code for Bellevue, Washington, though neither spelling of "TC SUS Holding LLC" is registered in Washington.
There is a TC SUS Holding LLC registered in New Mexico, but there's not much to go off of on the business registration.

Ageify says that it's a project of IDegrity, which links to another website, which is unfinished and has numerous broken links, including the Privacy Policy, Terms of Service, Secuity and Compliance pages. Additionally, there's no legal entity that I was able to track down called IDegrity.

Confusingly, there's another company called Ageify (age-ify.com), who also offers age verification services, and is based in Greece, but is unrelated to Ageify (Discord Bot).

GitHub

IDegrity exists as a GitHub organization, and owns two repositories. One repository is tooling for their Discod bot to talk to OpenTelemety. The other is documentation for their Discord bot. There's nothing particularly exciting in the OpenTelemetry repository, but in the docs repo, things get interesting with a commit from "jackarildson", our first real lead into who runs Ageify Bot, among all of the appearances of "Cookie".

AgeifyBot-Docs % git log
commit b1875dfb7d246da6f083305c6b044f829047a699 (HEAD -> main, origin/main, origin/HEAD)
Author: Your Name 
Date:   Wed Jan 17 12:33:47 2024 -0800

    added test text

If this jackarildson is the person who runs Ageify, this iss our first real lead into who's behind this. I found a LinkedIn account for a Jack Arildson that seems to line up, being located in Bellveue, WA, the same place as the phone number from earlier.

Jack's Instagram account shares a cat profile picture with the Spotify account of "Cookie", the operator of Ageify's support Discord.

Ageify, from information I've been able to find, does not appear to be much more than a side project from Jack Arildson, who works in DevOps at a clothing retailer, and seems to have no qualifications to be handling this kind of sensitive informmation.

Information Disclosures

Ageify's Privacy Policy is largely vague and non-specific, and lacks important clarifications and legally requied notices. Under the CPPA, California requires specific notices about what is being collected, retention periods, the purposes of it, at the point of collection.

The European Union's GDPR has similar requirements for privacy and data collection notices at the point of collection, which are not provided by Ageify.

Other Weirdness

Ageify's website lists their contact e-mail address as [email protected], however it has a mailto hyperlink to [email protected]. discordverify.com has no MX records, and thus cannot accept emails. discordverify.com is registered at a Russian domain registrar, REG.RU. It has one A record, which points to an IP announced by AS212189 IT-GRAD TOO, a Russian hosting company.

Conclusion

Nothing I've seen gives me confidence in Ageify's data security abilities. I would recommend against putting your information into Ageify or other similar sites. It just screams data harvesting operation.

I shouldn't have to say it.

Seriously, don't put your ID into one of these bots. I'm not convinced that any of these are anything more than elaborate data harvesting operations. You're putting yourself at risk by giving them information.

---

—portalz