Incode Technologies

What a bank buys is the model's call on whether a face and a document are real and belong together, made by face matching, passive liveness and deepfake detection models. Orchestration through MetaMap adds deterministic steps around that judgment without replacing it.

Each verification flow is built from condition nodes, and every branch ends in pass, fail, warn or manual review. Thresholds are adjustable per check, so a bank can run separate flows by region or product. Any session can be escalated to manual review. Sessions that fail automated checks open a case for the customer's own reviewers, who pass or fail it with a stated reason. Cases close with an audit trail and a tamper evident evidence export. Threshold values are the customer's to set, and no sampling of automated passes is published.

Each decision returns module scores for document, liveness, face match and device, with a plain language summary of what drove it. iBeta's Level 3 presentation attack test under ISO/IEC 30107-3, announced March 2, 2026, reported zero attack and bona fide errors on iOS and Android. A Purdue University study of nine deepfake detectors is cited in Incode's favor. A 99.80 percent figure appears with no method, and model validation and drift monitoring are not published.

False rejections at Davivienda fell from 12 to 5 percent and fraud from 0.5 to 0.1 percent, reported by its digital channels director. Klar's chief operating officer credits a 50 percent rise in credit access for thin file users and 1.8 times more purchases. Interac is quoted on choosing Incode for TrustGraph, while the up to 53 percent fraud uplift from early access names no institution. A claim of more than 7.1 billion checks comes with no method.

Biometric identifiers may train Incode's models where law allows, with consent where required. The self serve data processing addendum lists model training as a purpose Incode controls, with end users opting in through a separate checkbox. TrustGraph, launched in October 2026, keeps each institution's records with that institution and matches fraud signals by cryptography. Age checks are kept out of training. No stated boundary keeps one bank's applicants out of models serving another.

A privacy notice revised July 27, 2026 covers people verified through the service and sets out when Incode acts as processor and when as controller. Transfers run under standard contractual clauses. The biometric data policy keeps biometric data no longer than three years after a person's last interaction. The self serve data processing addendum deletes customer data within 30 days of termination and offers the subprocessor list on request.

A SafeBase trust center lists SOC 2 Type 2, ISO/IEC 27001:2022, ISO/IEC 42001:2023 and ISO/IEC 30107-3, with documents behind an access request. FedRAMP appears there at the Moderate level. Incode's November 2025 announcement describes FedRAMP Ready status after a readiness assessment, with authorization still to come. MetaMap shows its own SOC 2 and ISO 27001 marks, so whether it shares the same scope is left open.

Kantara's Trust Status List shows Incode Omni approved as an identity proofing component at Identity Assurance Level 2, effective November 14, 2025 and valid to November 30, 2028. It certifies identity proofing assurance rather than any model. Incode publishes no financial license of its own, and its self serve terms say it is not a consumer reporting agency and bar using results for credit decisions.

ISO/IEC 42001:2023 certification covers the AI management system. Incode submits its face recognition to NIST's FRTE evaluations, which measure demographic differentials independently. The face recognition page claims consistent accuracy across ethnicity, age and gender but shows no figure for any group. No bias testing method of Incode's own is published.

The self serve terms provide the service as is, make no warranty on the customer's decisions and cap Incode's liability at 12 months of fees, so the institution carries the loss. Its reviewers can reopen a failed session as an incorrect rejection and pass it by hand. Verified people get access, correction and deletion rights through a webform, but no route to contest a failed face match.

More than 35 detection models are built in house, which Incode says lets it retrain against a new attack in days. Identiq, acquired in June 2026, supplies the cryptography behind TrustGraph. The subprocessor list is available only on request, so whether an outside model provider touches biometric data cannot be confirmed.

Experian embeds Incode natively in its Ascend platform, Equifax is a named partner, and GovFaceMatch matches selfies against Georgia's driver records. The integrations marketplace lists Salesforce, ServiceNow and Okta. Mambu, Temenos, FIS, nCino, Apiture and Sopra appear in the developer hub as planned integrations, not live ones.

An unnamed major cloud provider hosts the service with a four hour recovery time objective and a one hour recovery point objective. No hosting region is named. The FAQ mentions regional storage options and possible on premises setups, but commits to neither and asks buyers to confirm both with Incode. GovFaceMatch runs Incode's models inside the state DMV's environment, and age checks can run on the user's phone.

Enterprise contracts are quoted, and no rate or tier is published. A self serve Basic Plan has its own published terms, dated April 21, 2026. It bills per transaction at a unit price set in the checkout order form, paid once a year in advance for a 12 month term. A transaction counts once any identity check runs in a session, whether or not onboarding finishes. The plan renews on its own, and the unit price then rises by 6 percent or the urban consumer price index increase, whichever is greater.

Financial services, fintech and neobanks, and crypto each have their own pages, beside government, telecom and other industries. The financial pages work through KYC, the Bank Secrecy Act and FinCEN customer identification rules. Incode says it serves eight of the top ten US banks and four of the top five in Latin America, and offers kiosk and in branch channels beside web and mobile. MetaMap adds government database checks across Latin America and Africa.