Security and compliance
Exact answers for your security review.
Faking a person got cheap, so every organization now has to check who is real. The check should be careful with real people’s data. Here is what Fuzzy keeps, what it leaves out, and the controls running today.
- Face image
- One. The badge photo, a photograph, not a faceprint.
- Date of birth
- Not kept on your profile. Age is kept as an 18+ attestation.
- What your team receives
- A clear outcome. Never a reason, never the ID.
- Where it lives
- AWS, United States regions.
Data
What we keep. What we leave out.
Fuzzy gets the verification without holding the biometrics. Incode, our identity engine, is the system of record for verification evidence. These are the fields reviewers ask about most.
What Fuzzy keeps
- Given name and family name, as on the ID
- An 18+ attestation, a single yes, set at verification
- Verification status and its dates
- City, region and country, taken from the document
- The still photo from verification, which becomes the badge photo
- Email address for the account
What the Fuzzy database leaves out
- Date of birth
- ID document numbers
- Street address and postal code
- ID document images and liveness videos
- A face template or biometric embedding from the verification pipeline
- A reason, on anything reported to a school, partner or the public
On the photo. The still image captured during verification becomes the badge photo. The face match runs inside Incode’s session against Incode’s own record, and Fuzzy reads back the outcome. Anyone with a badge link can see the photo, and link previews can show it. Badge photos are marked no-index so they stay out of search results, and a badge link that is turned off stops serving the photo.
Live today
Controls running in production.
Sweep detection
Rate limits count distinct people queried per hour, not total calls. Re-checking the same person is normal. Querying hundreds of different people fast is a sweep, and it gets throttled.
Encryption and storage
Buckets holding member images block all public access and use AES256 server-side encryption at rest. Traffic is encrypted in transit. Secrets live in AWS Secrets Manager.
Allowlisted results
The verification pipeline never stores a verbatim vendor payload. It keeps an allowlisted projection of scores and outcomes, so fields like date of birth and home address never land.
United States residency
Hosted on AWS in US regions, primarily us-east-1, with managed RDS for relational data and CloudFront for static delivery. No data residency outside the United States.
Member control
Members turn their badge link off and on, update their photo through a face match, choose what to show with Present ID, and delete their account in the app.
A small footprint
One authenticated API, server to server. Request ids on every call and idempotency keys, so a retry cannot double-record. Nothing to install on your network.
Architecture
Records that hold up. Data that stays in its lane.
An insider cannot rewrite history.
Audit records are append-only, enforced by the database itself, and chained with an HMAC under a key held outside the database. Someone with full write access but no key cannot alter a record and relink the chain.
Your access is scoped to your organization.
Every API credential belongs to one organization and can be revoked on its own. Reads are constrained to that organization. The credential record itself carries no organization reference, because the credential belongs to the person.
Certifications
Every certification carries its owner’s name.
Fuzzy is the credential layer. Identity checks run on Incode, and these certifications are Incode’s. We’ll send their documentation straight to your reviewer.
Held by Incode Technologies
- SOC 2 Type II
- ISO/IEC 27001, information security management
- Kantara Trust List, IAL2 under NIST 800-63A
- FedRAMP Ready (High baseline, announced November 2025)
Paperwork
Procurement paperwork, and where each piece stands.
Data processing agreement
A DPA is signed with each school at contract. Send your template and your counsel’s redlines.
HECVAT
Send your institution’s HECVAT and we’ll complete it for your review.
VPAT and Section 508
Conformance work runs alongside deployment. Ask and we’ll send the current status.
Plain answers
What reviewers ask us most.
What does a verified badge prove?
That a real person passed a government ID, selfie and liveness check, in about 55 seconds in the app. Renewal is the same full check every 12 months, with reminders.
What does my team receive?
A clear outcome for the person you asked about. Fuzzy reports that a check did not clear, never why. A result is an outcome, not a fraud finding.
Who makes the decision?
You do. Nobody is blocked for not completing a check. Your team keeps its own human review path and every decision, and the member’s app shows which step did not clear so they can try again.
What does someone see on a badge?
The name as on the ID, the badge photo (the verification selfie, never the ID photo), when the person was verified, and 18+ when attested. The ID document, date of birth and address are never shown.
Is the badge photo a faceprint?
No. It is a photograph. The verification pipeline creates and stores no face template, and the face match runs at Incode.
Ask us anything
Send the questionnaire. A person answers in writing.
Your security questionnaire, your HECVAT, your DPA template, or the 3 questions your CISO cares about most. Tell us early what your review needs and we’ll build the answers into your timeline.