T Stamp Inc

Overview

Trust Stamp was incorporated under the laws of the State of Delaware on April 11, 2016 as “T Stamp Inc.” T Stamp Inc. and its subsidiaries (“Trust Stamp”, “we”, or the “Company”) develop and market identity authentication software for enterprise and government partners and peer-to-peer markets.

Trust Stamp primarily develops proprietary artificial intelligence-powered solutions, researching and leveraging machine learning artificial intelligence, including computer vision, cryptography, and data mining, to process and protect data and deliver insightful outputs that identify and defend against fraud, protect sensitive user information, facilitate automated processes, and extend the reach of digital services through global accessibility. We utilize the power and agility of technologies such as GPU processing, edge computing, neural networks, and large language models to process and protect data faster and more effectively than historically possible to deliver results at a disruptively low cost for usage across multiple industries.

Our team has substantial expertise in the creation and development of AI-enabled software products. We license our technology and expertise in numerous fields, with an increasing emphasis on addressing diverse markets through established partners who will integrate our technology into field-specific applications.

Over the last twelve months, while maintaining our strong emphasis on identity authentication for financial services, the Company has undertaken a multi-pronged process to position itself better to leverage the growing opportunities offered by the expanded capabilities, use, and acceptance of AI technologies. This process has included:

• Reducing the size of the non-production-focused executive and consulting teams to reduce overhead.

• Releasing sales staff that did not meet their targets.

•Negotiating a services contract to offset the cost of the technical team members while maintaining significant R&D and product development capabilities.

•Refocusing go-to-market strategies on joint ventures with proven industry partners with access to target markets.

•Expanding our IP portfolio to strengthen our existing position related to presentation attack detection and tokenization and include implementations such as:

i. Embedded ownership verification for cryptographic assets, a technology that we believe to have significant potential with the expansion in the ownership of crypto-assets including potential deregulation (or loosening or clarification of regulation) in the United States together with the global growth of stable coins including Central Government Digital Currencies.

ii. A simple user interaction utility called “Shape Overlay” that augments biometric verification and combats deepfakes and injection attacks by having the user interact in real-time with their captured image.

iii. Stable Key (or “Stable IT 2”) which is an innovative technology that generates a “key” directly from the biometric of the user which key has a mathematical correlation to all of the user's passwords, PINS, and other “secrets” for every account and use case meaning that those secrets never need to be stored in their entirety.

iv. A patent for “Interoperable Biometric Representations” that potentially breaks vendor lock-in by allowing users of biometric technologies to compare like-modality templates from different sources.

•Strengthening our international 3rd party cybersecurity and data handling certifications by adding SOC2 certification to our NCSC Cyberessentials Plus certification and obtaining a renewed D-Seal certification (the world’s first certification that includes not just data security but also the ethical and responsible use of data).

•Opening an office in Tokyo (with funding from the City of Tokyo and the Japanese government) to pursue opportunities in the APAC region.

•Retaining an investment bank to explore strategic partnership and M&A opportunities across multiple sectors.

Markets

Trust Stamp has evaluated the market potential for its services in part by reviewing the following reports, articles, and data sources, none of which were commissioned by the Company, and none of which are to be incorporated by reference:

Data Security and Fraud

•According to the “2021 Year End Report: Data Breach QuickView” published by Flashpoint, 4,145 publicly disclosed breaches exposed over 22 billion records in 2022.

•The cumulative merchant losses to online payment fraud between 2023 and 2027 will exceed $343 billion globally according to a 2022 report titled “Fighting Online Payment Fraud in 2022 & Beyond” published by Juniper Research.

Financial and Societal Inclusion

•According to the “Global Findex Database 2021,” published by the World Bank, 1.4 billion people were unbanked as of 2021.

•131 million small and medium-sized enterprises in emerging markets lack access to finance, limiting their ability to grow and thrive (UNSGSA Financial Inclusion Webpage, Accessed March 2023).

•The global market for Microfinance is estimated at $157 Billion in the year 2020 and is projected to reach $342 billion by 2026 according to the 2022 report titled “Microfinance - Global Market Trajectory & Analytics” published by Global Industry Analysts, Inc. To accelerate our work in this market, the Company has joined the Mastercard Lighthouse MASSIV program designed to empower sustainability and social impact through strategic partnerships aiming to assist participants to scale on a global level.

Trust Stamp’s biometric authentication, liveness detection, and information tokenization enable individuals to verify and establish their identities using data derived from biometrics. While individuals in this market lack traditional means of identity verification, Trust Stamp provides a means to authenticate identity that preserves an individual’s privacy and control over that identity.

Alternatives to Detention (“ATD”)

•The ATD market includes Federal, State, and Municipal agencies for both criminal justice and immigration purposes. Trust Stamp addresses the ATD market with applications built on Trust Stamp’s privacy-preserving solutions allowing individuals to comply with ATD requirements using ethical and humane technology methodologies. Trust Stamp has developed innovative patented technologies for use in the ATD market encompassing biometrics, geolocation, and tokenization as well as a proprietary, tamper-resistant, battery-free “Tap-In-Band” that can complement or replace biometric check-in requirements and provide a lower-cost and more humane alternative to traditional “ankle bracelet” technology.

In December 2024 we announced a go-to-market agreement with a leading provider of software solutions to the U.S. Federal Government and we are currently pursuing a revised go-to-market strategy based on the priorities of the administration.

Other Markets

The Company is developing products and working with partners and industry organizations in other sectors that offer significant market opportunities for our existing and pipeline IP and has entered into go-to-market or licensing agreements, including global data location services, healthcare, IoT, access control, smart home systems, and computer vision for UAV operations. We anticipate licensing our technology in numerous fields, typically through established partners who will integrate our technology into field-specific applications.

Africa

The African Continental Free Trade Area (AfCFTA) is a landmark agreement that binds 54 African nations and an estimated 1.47 billion people into the world’s largest free trade area. AfCFTA has significant economic potential for Africa, as it aims to create a single market for goods and services across 55 countries, representing over 1.3 billion people with a combined GDP of approximately $3.4 trillion. By reducing trade barriers, the agreement could contribute an additional $450 billion to Africa’s GDP by 2035, lifting 30 million people out of extreme poverty and increasing the incomes of 68 million people, according to the World Bank. Over the next decade, Africa’s share of the world population is projected to reach 21%, up from 13% in 2000. More than 50% of young people entering the workforce will be in sub-Saharan Africa. By 2050, the region’s working-age population will still be rising while it is falling virtually everywhere else, and Africa will be home to an estimated 2.5 billion people, or 25% of all humanity.

Globally, 850 million people did not have identity documents in 2023, with 542 million in Africa. Of that 542 million, 95 million are children who have never had their birth recorded, and 120 million are children without a birth certificate. The single initiative of implementing universal tokenized identity in African countries has the potential to significantly boost the implementing countries' economies. According to the United Nations Economic Commission for Africa (UNECA), countries adopting digital ID programs could unlock economic value equivalent to 3% and 13% of their GDP by 2030.

A transition to digital records for births, marriages, deaths, and electronic identity documents represents a transformative opportunity for developing nations and builds a foundation for economic growth. Establishing a robust digital infrastructure for vital records enhances administrative efficiency, fosters inclusive development, strengthens governance, and unlocks economic potential. Yet, developing African countries are often unable or unwilling to fund the initial capital expenditure required to make the transition.

Trust Stamp has participated in financial inclusion projects in Africa for a number of years through Mastercard’s implementation of our technology and we established a regional R&D center in Rwanda in 2021 to focus on ensuring equity in the development and implementation of biometric technology in Africa. In 2023 we started direct outreach to African countries to initiate national-level digital identity programs and we are in serious and extended dialog with two countries as well as a pilot with Africa’s largest provider of mobile telecommunications services. With the assistance of the Mastercard Lighthouse MASSIV program, we intend to build upon this work to maximize the opportunities to meet the critical need for secure identity programs for both governments and NGOs.

Principal Products and Services

We adhere to the best practices outlined in the National Institute of Standards and Technology (“NIST”) and International Organization for Standardization (“ISO”) frameworks, and our policies and procedures in managing personally identifiable information (“PII”) comply with General Data Protection Regulation (“GDPR”) requirements wherever such requirements are applicable.

The IT 2 replaces biometric templates and scans with meaningless numbers, letters, and symbols to remove sensitive data from the reach of criminals using a proprietary process by which a deep neural network irreversibly converts biometric and other identifying data, from any source, into the secure tokenized identity. This IT 2 is unique to the user, is different every time it is generated from a live subject, and cannot be reverse-engineered and rebuilt into the user’s face or other original identity data.

Each token can be stored and compared to all other tokens from the same modality, allowing the Company’s AI-powered analytics to predict if a single subject has generated two or more tokens, even if the subject has passed conventional KYC with, e.g., falsified identity documents. Using this technology, an IT 2 can be employed for re-authentication purposes, including account recovery, password-less login, new account creation, and more, across the organization or even within a consortium of organizations, all in a low-cost and low-friction delivery that is fast and secure.

Our technology is being used for enhanced due diligence, KYC/AML compliance, synthetic identity fraud reduction and “second chance” approval for customer onboarding and account access, together with the delivery of humanitarian and development services. The solution allows organizations to approve more users, keep bad actors from accessing systems and services, and retain existing users with a superior user experience.

Our hashing and matching technology can maximize the effectiveness of all types of identity data while rendering it safer to use, store, and share. Whatever the source of identity data, it can be stored and compared as an IT 2. See the chart below for examples.

Distribution

Through licensing we allow customers to utilize our technology in a wide variety of applications. Uses can include (e.g.):

•The provision of services and hashing to enterprises, NGOs, and government, to overlay on third-party biometric and identity data.

•Hash licensing, translation, and certification services for biometric vendors.

•Management of zero-knowledge-proof services, whether as a tributary between Identity Lakes or operating consortium lakes.

•Tokenized identity creation for large scale deployments, such as humanitarian and government identity programs.

Licensing Agreements

License agreements are typically a hosted offering, on-premise solution, or both pursuant to which the customer pays for the initial product development plus a license fee for the use of Trust Stamp’s technologies on a periodic and/or volume-based basis. In addition to consuming and paying for Trust Stamp’s services for their own use, some key customers also serve as channel partners by offering Trust Stamp products to their own customer base, whether as stand-alone products, or integrated into their own services as upgraded product offerings.

SaaS Agreements

Software-as-a-Service ("SaaS") agreements are typically serviced through the Company’s Orchestration Layer platform, which is being utilized in new global identity authentication system with Fidelity Information Services, LLC ("FIS"). The platform includes our proprietary tokenization technology and is designed to provide easy integration with and access to, Trust Stamp’s products, chargeable on a per-use basis. The Orchestration Layer facilitates no-code and low-code implementations, making adoption faster and even more cost-effective for a broader range of potential customers. It is expected to accelerate the Company’s evolution, from being exclusively a custom solutions provider, to also offering a modular and highly scalable SaaS model with low-code implementation.

Competition

We can potentially work with any identity data from any source, potentially breaking vendor and modality lock-in, but our primary market target is the biometric service industry, which is growing exponentially while being threatened by a consumer, media, and legislative backlash against storing biometric data. The IT 2 can potentially be overlaid on any biometric or other identity data provider.

In general, we compete for customer budget with any company in the identity authentication industry. Major competitors in this space include companies such as NEXT Biometrics, IDEMIA, Synaptics, Cognitec, Innovatrics, Suprema, FaceTec, Rank One Computing, Acuant, Jumio, Onfido, Ping, and Mitek. However, we believe that, due to the uniqueness of our technology solution, the Company does not currently have any direct competitors for the core IT 2 solutions upon which the growth in our business plan is focused.

The commercial advantage of our solution is our ability to work across providers and modalities and we continue to pursue a first-mover advantage including our global–scale partnership which is achieving a network effect in the global Humanitarian and Development market. We believe that this combination will make it unattractive for a potential competitor to replicate the six-years and multi-million dollars that we have already expended, to try and circumvent our multiple (and continuing) patent filings and/or offer a parallel product based upon a different technology.

We believe that given sufficient time and resources, we can augment any biometric modalities including face, hand, iris, voice, gait, and behavior, together with any other identifying data which places us in a unique position versus providers of biometric services.

We are unaware of any other provider being able to offer or support a proliferation of authentication modalities in this fashion, and therefore we believe there are no other companies that directly compete with us in this space. If our go-to-market strategy is successful, biometric service providers can be channel distributors, and not necessarily competitors.

Growth Strategy

Our strategy is to:

•Expand the scope and range of services that we provide to and through our existing clients.

•Continue to add significant new clients for our current and future services.

•Offer our services via channel partners with substantial distribution networks.

•Offer our technology on a “low code” basis, providing access via an orchestration layer and/or open-APIs to enable implementation by a broader range of clients.

•The addition of alternate authentication tools including non-facial-biometric options and non-biometric-knowledge and device-based tools facilitating two and multi-factor authentication.

•Offer our IT 2 technology for use by other biometric and data services providers to protect and extend the usability of their data.

•Provide ready-to-use / customizable platforms that leverage our IT 2 technology in specialized markets.

Human Capital

Given the geographic diversity of its team, and to facilitate cost-effective administration, Trust Stamp secures the services of its permanent team members through a variety of administrative structures that include wholly owned subsidiaries, professional employer organizations, and consulting contracts. As of December 31, 2024, the Company had 7 full-time and 2 part-time team members that work out of the United States, 25 full-time members that work out of Malta, 10 full-time team members in Poland and Central Europe, 1 full-time and 1 part-time team members in the United Kingdom, 1 full-time team member in the Isle of Man, 14 full-time team members and 2 part-time team members working in the Philippines, 11 full-time team members working in Rwanda, 2 full-time team members in Denmark, and 1 full-time team member working in India. Our permanent team is augmented as needed by contract development and other staff on both a long and short-term basis.

Outsourcing

We design and develop our own products. We use an outsourcing company, 10Clouds, for additional development staff as needed. 10Clouds is considered a related party. In addition, we also utilize SourceFit, a company in the Philippines, for PEO services, representing approximately 2% of our operating expenses during the year ended December 31, 2024. Amazon Web Services provides cloud hosting and processing services, representing approximately 4% of our operating expenses during the year ended December 31, 2024.

Key Customers

The Company’s initial business consisted of developing proprietary privacy-first identity solutions and implementing them through custom applications built and maintained for a few key customers. In the fourth quarter of 2022, the Company added to its product offerings a modular SaaS model intended for low-code or no implementation (“the Orchestration Layer”). The Orchestration Layer has been successful in attracting interested customers with over sixty financial institutions onboarded as of the date of this report, but those institutions have been slow to go into full production which has impacted revenue expectations. An analysis of the slow adoption revealed that many of the institutions would need some level of customization and in fourth quarter of 2024 and first quarter of 2025 the company has invested in modification of the modules to meet the broader range of needs and preferences identified by the enrolled institutions. Orchestration Layer 2.0 will be “relaunched” in the second quarter of 2025.

Historically, the Company generated most of its income through two long-term partnerships, comprising a relationship with an S&P 500 bank with services provided pursuant to a Master Software Agreement entered into in 2017, together with a relationship with Mastercard International (“Mastercard”) with services provided under the terms of a ten-year technology services agreement entered into in March 2019 (the "TSA”). Both of those relationships remain strong, and the Company anticipates future revenue growth from the two relationships.

Under the TSA, IT 2 TM technology is being implemented by Mastercard for Humanitarian & Development purposes as a core element of its Community Pass and Inclusive Identity offerings. Use cases include not only financial services for individuals and businesses but also empowering people and communities to meet basic needs, such as nutritious food, clean water, housing, education, and healthcare. The Company is paid to develop and host software solutions utilizing the IT 2 and to support Mastercard’s implementations. In addition, the Company is paid on a “per user per year” basis for all transactions utilizing its technology. In December of 2022, the Company entered into a modification of the agreed pricing schedule with Mastercard to move from a per-use to a per-user-year model to broaden the range of potential use cases. The TSA may be terminated by either party in the event of a material breach by the other party that remains uncured within thirty days after notice is received of such a breach. Either party may terminate the TSA if the other party becomes, including, but not limited to, insolvent, subject to bankruptcy, dissolved, or liquidated. Unless the TSA is terminated, the TSA will automatically renew for additional one year-periods in perpetuity unless either party provides ninety days written notice of intent not to renew. To date, the Company has received guaranteed minimum annual payments on account of usage. According to the October 2023 interview of Mastercard Executive Vice President and Founder of the Community Pass from the article titled “Mastercard’s Community Pass founder says digital ID platform improving lives, digital inclusion” published by Biometric Update. Mastercard’s Community Pass program currently serves approximately 3.5 million users and is targeting 30 million users by 2027.

In 2022, the Company expanded its key customer base to include a relationship with FIS, a relationship-focused upon the implementation of our Orchestration Layer and underlying technologies in FIS’ Global KYC product offering.

The Orchestration Layer is a low-code platform that is designed to be a one-stop shop for Trust Stamp services and provides easy integration to our products; chargeable on a per-use basis. The Orchestration Layer utilizes the Company’s next-generation identity package, offering rapid deployment across devices and platforms, with custom workflows that seamlessly orchestrate trust across the identity lifecycle for a consistent user experience in processes for onboarding and KYC/AML, multi-factor authentication, account recovery, fraud prevention, compliance, and more. The Orchestration

Layer facilitates no-code and low-code implementations of the Company’s technology making adoption and updating faster and cost-effective for a broader range of potential customers.

As of December 31, 2024, a total of 66 financial institutions with over $348 billion in assets have been onboarded via FIS, bringing the total number of (FIS and non-FIS) customers either fully implemented or are currently implementing the Orchestration Layer to 79. The first (non-FIS) client onboarded to the Orchestration Layer in the third quarter of 2022 has generated $426 thousand of revenue for the Company to date including $193 thousand during the year ended December 31, 2024.

Regulation

Our business is not currently subject to any licensing requirements in any jurisdiction in which we operate, other than the requirement to hold a business license in the City of Atlanta (with which we are in compliance), and the requirement to hold a trading license in Rwanda (with which we are in compliance). Given the significant focus on the use of biometrics in many countries, we do anticipate additional regulation being introduced in one or more jurisdictions in which we operate, and such requirements could be burdensome and/or expensive or even impose requirements that we are unable to meet.

We are subject to substantial governmental regulation relating to our technology and will continue to be for the lifetime of our Company. By virtue of handling sensitive PII and biometric data, we are subject to numerous statutes related to data privacy, and additional legislation and given the current focus on the collection, storage, and use of biometrics, additional regulation should be anticipated in every jurisdiction in which we operate. Examples of regulations we could be subject to are:

•Health Insurance Portability and Accountability Act (HIPAA)

•Health Information Technology for Economic and Clinical Health Act (HITECH)

•The General Data Protection Regulation 2016/679 (GDPR)

•ePrivacy Privacy Directive

•The California Privacy Rights Act (CPRA)

•The California Consumer Privacy Act (CCPA)

•Biometric Information Privacy Act (BIPA)

•Act on the Protection of Personal Information (APPI)

•United Kingdom General Data Protection Regulation (UK GDPR)

HIPAA and HITECH

Under the administrative simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act “HITECH”), the U.S. Department of Health and Human Services (“HHS”) issued regulations that establish uniform standards governing the conduct of certain electronic healthcare transactions and requirements for protecting the privacy and security of protected health information (“PHI”), used or disclosed by covered entities and business associates. Covered entities and business associates are subject to HIPAA and HITECH. Our subcontractors that create, receive, maintain, transmit, or otherwise process PHI on behalf of us are HIPAA “business associates” and must also comply with HIPAA as a business associate.

HIPAA and HITECH include privacy and security rules, breach notification requirements, and electronic transaction standards.

The privacy rules cover the use and disclosure of PHI by covered entities and business associates. The privacy rules generally prohibit the use or disclosure of PHI, except as permitted under certain limited circumstances. The privacy rules also set forth individual patient rights, such as the right to access or amend certain records containing his or her PHI, or to request restrictions on the use or disclosure of his or her PHI.

The security rules require covered entities and business associates to safeguard the confidentiality, integrity, and availability of electronically transmitted or stored PHI by implementing administrative, physical, and technical safeguards. Under HITECH’s Breach Notification Rule, a covered entity must notify individuals, the Secretary of the HHS, and in some circumstances, the media of breaches of unsecured PHI.

In addition, we may be subject to state health information privacy and data breach notification laws, which may govern the collection, use, disclosure, and protection of health-related and other personal information. State laws may be more stringent, broader in scope, or offer greater individual rights with respect to PHI than HIPAA, and state laws may differ from each other, which may complicate compliance efforts.

Entities that are found to be in violation of HIPAA as the result of a failure to secure PHI, a complaint about our privacy practices, or an audit by HHS, may be subject to significant civil and criminal fines and penalties and additional reporting and oversight obligations if such entities are required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance.

GDPR

The European Union's General Data Protection Regulation ("GDPR") imposes onerous accountability obligations requiring data controllers and processors to maintain a record of their data processing and policies. It requires data controllers to implement more stringent operational requirements for processors and controllers of personal data, including, for example, transparent and expanded disclosure to data subjects (in a concise, intelligible, and easily accessible form) about how their personal information is being used, imposes limitations on retention of information, increases requirements pertaining to health data and pseudonymized (i.e., key-coded) data, introduces mandatory data breach notification requirements, and sets higher standards for data controllers to demonstrate that they have obtained valid consent for certain data processing activities. Fines for non-compliance with the GDPR will be significant—the greater of €20 million or 4% of global turnover. The GDPR provides that European Union member states may introduce further conditions, including limitations, to make their own further laws and regulations limiting the processing of genetic, biometric, or health data.

ePrivacy Directive

The ePrivacy directive sets out the rules relating to the processing of personal data across public communications networks. This directive requires businesses to ensure consent requests are made and that consent is received from the user before the use of cookies is made. Businesses must communicate the privacy rules with accurate and specific information regarding the data contained in the cookie. Information must be communicated before the consent requests are made, in plain language. Organizations must ensure that users are able to withdraw consent in the same simple manner as the initial consent request.

CPRA and CCPA

The California Privacy Rights Act ("CPRA") and the California Consumer Privacy Act ("CCPA") define and establish various rights that consumers residing in California have over the privacy of their data along with the responsibilities of businesses when collecting personal information. It requires businesses that control the collection of consumers’ personal information to inform them of the category, purpose, and duration the business intends to retain such information. It lists the consumers’ right to correct their data and have their data deleted. Customers may also exercise their right to limit the sale or sharing of their personal or sensitive personal information. Fines for non-compliance can range from $100 to $750 per consumer per incident. Additionally, in certain cases, the California Privacy Protection Agency may impose administrative fines ranging from $2,500 to $7,500 for each violation.

BIPA

The Biometric Information Privacy Act ("BIPA"), which was enacted in 2008, addresses the collection, use, and retention of biometric information by private entities. Under the law, a private entity must inform an individual, or their legally authorized individual, that the biometric information is being collected and stored, and the specific purpose and the length of time for the collection, storage, and use of the biometric information, before obtaining or possessing their biometric information for the purposes of capturing, storing or sharing it. In addition, prior to collecting any biometric information, the regulation required businesses to obtain a written release for the collection of the biometric information from the individual, or the individual’s legally authorized representative after notice has been given. BIPA provides statutory damages of up to $1,000 for each negligent violation, and up to $5,000 for each intentional or reckless violation.

APPI

The Act on the Protection of Personal Information (APPI) is Japan’s primary data protection law, first enacted in 2003 and significantly amended in 2016 and 2020 to align with global standards like the EU’s GDPR. It applies to businesses handling personal data, regardless of nationality or residency. The APPI defines personal data as any information that can identify an individual and classifies sensitive data to include details such as race, medical history, and criminal records. While consent is generally required for data collection, other legal bases exist, such as contractual necessity or compliance with legal obligations. Individuals are granted rights to access, correct, delete, and cease the use of their personal data. The Personal Information Protection Commission (PPC) enforces compliance, though penalties under the APPI are lower than those under GDPR, with a maximum fine of JPY 1 million.

UK GDPR

The United Kingdom General Data Protection Regulation (UK GDPR) applies to all organizations processing personal data of UK residents, regardless of where the organization is based. It defines personal data as any information that can identify an individual and includes special categories of sensitive data, such as health, race, and biometric data. Businesses must have a legal basis for processing data, such as consent, contractual necessity, or legal obligation. Individuals have rights over their data, including access, correction, deletion (right to be forgotten), and data portability. The Information Commissioner's Office (ICO) oversees compliance and can impose severe fines for breaches, reaching up to £17.5 million or 4% of global turnover. The UK also has additional rules for law enforcement and national security-related data processing.

Intellectual Property

Patents

A summary of the Company’s issued patents and pending patent applications on March 31, 2025 is provided in the table below.

Trademarks

The following is a summary of Trust Stamp’s issued and pending Trademarks as of March 31, 2025.

The Company added 6 patents and 1 trademark during the year ended December 31, 2024. The patents issued duringthe year ended December 31, 2024 increased our total number of patents to 23 and include:

•On January 2, 2024, the Company received Notice of Issuance for a patent that is a continuation of “Systems and Processes for Lossy Biometric Representation.” This patent is a continuation addresses a long-felt but unresolved need for a system or process that can transform size-variant, personally-identifying biometric templates into fixed-size, privacy-secured representations, while maintaining sufficiently accurate biometric matching capabilities.

•On January 30, 2024, the Company received Notice of Issuance for a patent that is a continuation of “Systems and Processes for Lossy Biometric Representation.” This technology provides a system or process that can transform size-variant, personally-identifying biometric templates into fixed-size, privacy-secured representations, while maintaining sufficiently accurate biometric matching capabilities.

•On March 19, 2024, the Company received Notice of Issuance for a patent entitled “Systems and Methods for Enhanced Hash Transforms.” Conventional cryptographic hashing techniques generally include functions that generate unique signatures given a piece of data, accepting binary strings of characters as an input, and producing a string (e.g., a digital signature) as an output. Our new patent addresses the need for improved techniques for securely handling sensitive data.

•On April 23, 2024, the Company received Notice of Issuance for a patent entitled “Face Cover-compatible Biometrics and Processes for Generating and Using Same.” which allows for enrollment of biometric information from individuals wearing face coverings such that subsequent biometric identification and verification processes may not require the individuals to remove their face coverings.

•On April 30, 2024, the Company received Notice of Issuance for a patent entitled “Systems and Methods for Liveness-verified, Biometric-based Encryption.” This patent fulfills a long-felt but unresolved need for a system or method that permits encryption/decryption based on liveness-verified biometric data that cannot be stolen or spoofed.

•On September 3, 2024, the Company received Notice of Issuance by the US Patent of Trademark Office of Patent No. 17/719,975 entitled, “Personal Identifiable Information Encoder." This technology provides the means to maintain the essential utility of PII without storing highly sensitive data. Anyone processing or storing PII should embrace this technology to fulfill their data protection obligations and mitigate damage and losses in the event of a data breach.”

Subsidiaries and Affiliates

Given the geographic diversity of our team and to facilitate cost-effective administration, Trust Stamp conducts various aspects of its operations through subsidiaries. All subsidiaries share resources across the entire Trust Stamp organization. The officers and directors of Trust Stamp have influence over the operations of all subsidiaries and employees across jurisdictions. Only one of our subsidiaries, Biometric Innovations Limited, has its own management team.

T Stamp Inc. Corporate Structure Chart

Operational Subsidiaries

Biometric Innovations Limited. (formerly “Trust Stamp Fintech Limited”). Biometric Innovations Limited is our Company’s United Kingdom ("UK") operating subsidiary. It was established to act as the contracting entity for development contractors in the UK, and it has its own board and management team. The purpose of this entity was to establish beachhead operations in the country to service a contract entered by the Company with the National Association of Realtors and Property Mark. This entity serves as a sales and marketing function for the product “NAEA” which was developed for the contract between the listed parties. On June 11, 2020, the Company entered into a stock exchange transaction with Biometric Innovations Limited, becoming a 100% owner of the entity. The stock exchange transaction was not pursuant to any formal written agreement.

Trust Stamp Malta Limited. Trust Stamp Malta Limited is a wholly owned subsidiary of T Stamp Inc. It operates an R&D campus in the Republic of Malta, for which it has entered into a lease with a local commercial landlord in Malta, Vassallo Group Realty Ltd. The goal of Trust Stamp Malta Limited is to advance our biometric authentication technology. As part of the creation of this entity, we entered into an agreement with the government of Republic of Malta for a repayable advance of up to €800,000 to cover 75% of the first 24 months of payroll costs for any employee who begins 36 months from the execution of the agreement on July 8, 2020.

Trust Stamp Rwanda Limited. Trust Stamp Malta Limited established Trust Stamp Rwanda Limited and in April 2021 opened an office in Kigali, Rwanda. It operates as an R&D campus together with a back-office facility for the purpose of the Company's expansion into Africa.

Trust Stamp Denmark ApS. Trust Stamp established Trust Stamp Denmark ApS on June 6, 2021 as a wholly owned subsidiary in Copenhagen, Denmark. Trust Stamp Denmark ApS focuses on developing and marketing GDPR compliant products in the European Union from a strategic Danish base that can passport authorized products throughout the European Union. In furtherance of that goal, Trust Stamp Denmark ApS has obtained D-Seal Certification.

Quantum Foundation. Trust Stamp Malta Limited established Quantum Foundation on October 13, 2022 as a wholly-owned subsidiary in the Republic of Malta. The purpose of the entity is to support the development of early-stage leading edge technology companies in the Republic of Malta.

Non-Operational Subsidiaries

Tstamp Incentive Holdings. On April 9, 2019, management created a new entity, Tstamp Incentive Holdings (“TSIH”) to which the Company issued 21,368 shares of Class A Common Stock that the Board of Directors of TSIH could use for employee stock awards in the future. The purpose of the entity was to provide an analogous structure to a traditional stock incentive plan. As of December 31, 2024 and the date of this report, no shares of Class A Common Stock are held by TSIH as all shares have been issued pursuant to employee Restricted Stock Units. The Company has completed the process of administratively dissolving TSIH with the dissolution was effective February 13, 2025.

Trusted Mail Inc. The Company established Trusted Mail Inc. for development of an encrypted e-mail product (Trusted Mail ®) using the Company’s facial recognition technology. Trusted Mail technology is held by Trusted Mail, Inc., which is a majority-owned subsidiary of Trust Stamp Inc.. The remainder of Trust Mail Inc. is owned by FSH Capital, LLC and Second Century Ventures, which are related parties of the Company. As of the date of this report, this entity has no operations, and is essentially dormant.

Cheltenham AI LTD. The Company established Chelthenham AI LTD on July 29, 2019 as a UK private limited company to provide AI services in the UK. As of the date of this report, this entity has no operations and is essentially dormant.

Finnovation LLC. The Company established Finnovation LLC to provide an innovative FinTech, Blockchain and Digital Identity innovation incubator. As of the date of this report, this entity has no operations and is essentially dormant.

TSI GovTech Corporation. Trust Stamp established TSI GovTech Corporation to contract for data management and server operations in Canada. As of the date of this report, this entity has no operations and is essentially dormant.

Global Server Management Inc. The Company established Global Server Management Inc. to contract for data management and server operations in Canada. As of the date of this report, this entity has no operations and is essentially dormant.

Trust Stamp Nigeria Limited. Trust Stamp Malta Limited established Trust Stamp Nigeria Limited on January 31, 2024 as a wholly-owned subsidiary in Lagos, Nigeria. The establishment of the entity is aimed at exploring business opportunities and conducting operations in Nigeria. As of the date of this report, this entity has no operations and is essentially dormant.

Available Information

Our website is www.truststamp.ai. As soon as reasonably practicable after such material is electronically filed or furnished to the Securities and Exchange Commission ("SEC"), our annual reports, quarterly reports, and current reports on form 8-K and all amendments to those reports are available on this website, free of charge.

Alternatively, you may access these reports at the SEC’s website at www.sec.gov.