The Incode Android SDK builds on a set of third-party libraries and services. This page lists them by purpose so you can complete your own privacy review, Google Play Data safety form, and internal SDK inventory. It describes the SDK's own dependencies; your app may add others.
Scope and accuracy
- Exact pinned versions move with each release. The authoritative, per-version list lives in the API Changes and dependency sections of the release notes.
- This page groups dependencies by purpose rather than reproducing the full transitive tree.
- Tools used only to build the SDK (the Kotlin compiler, Gradle, annotation processors) are not shipped in your app and are omitted.
- Libraries used only by the Incode sample/demo app are out of scope; they are not part of the published SDK and do not ship in your app.
How data is handled
Capture and biometric processing happen on the device. The SDK sends capture artifacts and verification requests to the Incode Platform over an encrypted channel. It does not log PII or captured content.
For more detail, see Data Handling and Privacy in the Incode Android SDK Reference and End-to-End Encryption (E2EE).
Capture, media, and on-device processing
| Library | Purpose | Used by |
|---|---|---|
AndroidX CameraX (androidx.camera:*) |
Camera capture and preview | ID, selfie, and document capture |
JPEG2000 decoder (dev.keiji.jp2) |
Decodes the portrait image stored on an ID chip | NFC Scan |
| JMRTD + SCUBA | Standard eMRTD (ePassport) chip-reading protocol stack (BAC / PACE) | NFC Scan |
Screen/video recording (HBRecorder) |
Records the video session | Video Selfie |
The SDK's on-device machine-learning models (liveness / presentation-attack detection, face recognition, ID face detection, face occlusion, age estimation) are Incode components, shipped as the model-* modules - see Incode Android SDK Reference. They run locally on the device.
Networking and storage
| Library | Purpose |
|---|---|
| Retrofit + OkHttp | HTTP client for requests to the Incode platform |
kotlinx.serialization, org.json |
Request/response serialization |
| Room | Local database (used for delayed / offline onboarding state) |
| SQLCipher, AndroidX Security Crypto, Google Tink | Standard encryption libraries for on-device data at rest |
| AndroidX DataStore | Encrypted local preferences / session state |
Platform services
| Library / service | Purpose | Notes |
|---|---|---|
Google Play Services - base, location, vision (com.google.android.gms:*) |
Platform services and device location | Used on devices with Google Play Services |
| Huawei Mobile Services - location | Device location on Huawei devices without Google Play Services | Selected at runtime when Google Play Services is unavailable - see Advanced Integration: Dynamic Delivery |
AndroidX Credentials (androidx.credentials:*) |
Provisioning a credential to Google Wallet | Google Wallet ID and the wallets dependency |
Contact, localization, and UI
| Library | Purpose |
|---|---|
libphonenumber (io.michaelrocks:libphonenumber-android) |
Phone-number parsing and validation - Phone |
| Lottie, Paris, Material Components, Accompanist | UI, theming, and animations - see Customization |
| restring, reword, viewpump | Runtime string localization |
Real-time video
| Library / service | Purpose |
|---|---|
| OpenTok (Vonage Video) | Real-time video conferencing with a remote agent - Conference (Assisted Video). Pulled in by the video-streaming dependency. |
Telemetry and diagnostics
| Service | Purpose | Notes |
|---|---|---|
| Statsig | Feature flags and experimentation | Disabled automatically in Capture-Only and Delayed (offline) modes |
| Sentry | Crash and error reporting | Can be turned off with setCrashReportingEnabled(false) - see Installation |
Risk and antifraud
| Capability | Purpose | Notes |
|---|---|---|
| Device-risk provider | Optional third-party device-risk and antifraud signals | Active only when enabled by your Incode configuration; the SDK runs without it when it is not provisioned. See Antifraud. |
Framework and utility libraries
These support the SDK internally and do not collect end-user data:
- Dependency injection: Dagger, Koin
- Asynchronous / reactive: RxJava 2, Kotlin Coroutines
- Logging: Timber (the SDK does not log PII or capture content)
Release hardening
The SDK's published release artifacts are obfuscated. This is a build-time step; it does not change the runtime behavior your integration relies on.
Related pages
- Release notes - exact dependency versions per release, in the dependency sections
- Incode Android SDK Reference - SDK overview, modules, and data-handling summary
- Installation - dependencies you declare, and how to disable crash reporting
- Individual Modules - the module catalog