Research subagent (Dana Whitfield's session)

{
  "command": "cat /Users/warrenthompson/Source/LoginID/CLAUDE.md; echo \"-----\"; cat /Users/warrenthompson/Source/LoginID/01-product-industry-research-design/CLAUDE.md"
}

# LoginID Take-Home POC — Project Root

## Role

You are the project manager agent for this repository. This file is the shared context every track refers back to. Each of the five track directories below has its own CLAUDE.md that can be worked independently by a scoped subagent, but that subagent should read this root file first for the assignment, the overall narrative, and how its track fits with the other four.

When you spin up agents or subagents to do work in a track, point them at that track's CLAUDE.md as their brief, and tell them this root file exists for cross-track context. Don't let a track's agent silently duplicate scope another track owns — check the "Owns / does not own" boundaries below first.

## What this repository is

This is a take-home assignment for a LoginID interview, submitted as a full directory. The goal is not just to answer three coding questions — it's to demonstrate capability as an AI architect: how you scope a problem, use AI tooling deliberately, reason about security and data, and produce something that reads as an intentional, well-run engineering effort rather than a quick script.

Code does not need to work or be fully complete. LoginID has said explicitly they care more about the design and the reasoning behind it, and about which AI tools/frameworks were used and how. Every track should document its reasoning, not just its output.

## The assignment (verbatim from LoginID)

Provide code solutions for the following questions in Go (preferably) or other languages — describe any tool, framework, or AI used.

1. Code of a database DAO that can store and retrieve `user_profile` (name, address, phone) and `user_credential` (username, method, password), with support for multiple databases (PostgreSQL or CockroachDB, SQLite, etc).
2. Design a RESTful API web service to search and retrieve the above user profile data, plus security API authentication.
3. Design a service connector to third-party identity providers (referred to generically as ABC or XYZ) to retrieve personal data from vendors, with the following endpoints:
   - `/auth` — retrieves an `access_token` based on a POST JSON body `{"username": "<string>", "password": "<string>"}`
   - `/identity` — retrieves user PII (name, phone, address: `street_address`, `locality`, `region`, `postal_code`, `country`) based on a POST JSON body `{"phone": "<string>", "name": "<string>"}`

Go is the preferred language. Other languages are acceptable if justified.

## Track structure

Five directories, each independently workable, each owning a distinct slice of the problem:

| Directory | Track | Owns |
|---|---|---|
| `01-product-industry-research-design/` | Product & Industry Research (incl. Design) | Market/industry framing (IAM, passwordless auth, IDP aggregation space), personas and use cases, API and data contract design rationale, UX of the surfaces that would sit on top of this |
| `02-ai-security-architecture/` | AI Architecture & Security Architecture | The AI tooling/workflow used to produce this submission, threat modeling, auth/authz design for the API, credential and PII handling, secrets management, third-party connector security |
| `03-engineering-delivery/` | Engineering & Delivery | The actual Go code for all three questions, project structure, test strategy, delivery documentation |
| `04-infra-devops/` | Infra & DevOps | How this would be built, containerized, deployed, and operated — CI/CD, environments, multi-database configuration, observability |
| `05-data-ops/` | Data Ops | Data modeling for `user_profile` / `user_credential`, multi-database abstraction strategy, migrations, PII data governance and retention |

Directories are numbered for reading order in the final submission, not for sequencing of work — tracks can be worked in any order or in parallel.

## Working principles for every track

- State your reasoning, not just your conclusion. LoginID is grading the "why" as much as the "what."
- Name the AI tool/workflow you used for that track's output (this project is being built with Claude Code; say so, and say how — e.g., subagents scoped per track, a given skill, a given model).
- Keep each track's CLAUDE.md self-contained enough that a fresh agent with no other context can pick it up and do correct work from it alone, plus this root file.
- Cross-reference other tracks by relative path (e.g., `../05-data-ops/CLAUDE.md`) rather than restating their content.
- Do not start writing code until each track's CLAUDE.md is in place and reviewed.

## Status

Scaffolding phase — track directories and their CLAUDE.md files are being established. No implementation work has started yet.
-----
# Track: Product & Industry Research (incl. Design)

Refer back to `../CLAUDE.md` for the full assignment text and how this track fits with the other four.

## Mission

Frame the three assignment questions as a real product problem, not just three isolated coding exercises. Show industry awareness of the space LoginID operates in — identity, authentication, and credential/PII management — and use that framing to justify the design choices the engineering track implements.

## Owns

- Industry/competitive framing: where this kind of DAO + REST API + third-party IDP connector fits in the identity/IAM landscape (e.g., how it compares to what LoginID itself does with passkeys/FIDO2, and why a password-and-username-based `user_credential` model is the deliberately simpler baseline the assignment is asking for).
- Personas and use cases: who calls this API, why they need to search/retrieve user profile data, and why a service would need to pull PII from a third-party identity provider rather than owning that data itself.
- API and data contract design rationale from a product lens: what fields belong in `user_profile` vs `user_credential`, what "search/retrieve" needs to support, and why the `/auth` and `/identity` connector contracts are shaped the way LoginID specified them.
- Any UX/design artifacts for surfaces that would sit on top of this (e.g., an admin console for profile search, an onboarding flow that triggers the IDP connector) — light-touch, this is a backend assignment, so design work here should support the narrative rather than compete with it for attention.

## Does not own

- Actual security threat modeling and authn/authz mechanics for the API — that's `../02-ai-security-architecture/CLAUDE.md`.
- The Go implementation — that's `../03-engineering-delivery/CLAUDE.md`.
- Database schema and multi-DB strategy — that's `../05-data-ops/CLAUDE.md`.

## Deliverables

- A short industry/competitive framing document.
- Persona and use-case notes tied directly back to the three assignment questions.
- Design rationale for the API surface and the third-party connector contracts, written so the engineering track can implement against it without re-deriving the reasoning.

## AI tooling note

Record which AI tool/workflow produced this track's output (this project is being built with Claude Code) and how — e.g., research done via a scoped subagent reading this file as its brief.

{
  "command": "ls -la /Users/warrenthompson/Source/LoginID/01-product-industry-research-design/"
}

.rw-r--r--@ 2.4k warrenthompson 12 Sep 09:18 CLAUDE.md

{
  "query": "select:WebSearch,WebFetch",
  "max_results": 5
}

[tool reference: ]
[tool reference: ]

{
  "query": "LoginID passwordless authentication FIDO2 company founders"
}

Web search results for query: "LoginID passwordless authentication FIDO2 company founders"

Links: [{"title":"FIDO2: What It is and How It Works | Frontegg","url":"https://frontegg.com/blog/fido2"},{"title":"LoginID | FIDO Alliance","url":"https://fidoalliance.org/company/loginid/"},{"title":"FIDO2 Authentication: Towards a passwordless future - LoginTC","url":"https://www.logintc.com/fido2-authentication/"},{"title":"FIDO2 Passwordless Authentication Explained","url":"https://www.pingidentity.com/en/resources/blog/post/fido2-passwordless.html"},{"title":"FIDO2 Passwordless Authentication | YubiKey | Yubico","url":"https://www.yubico.com/authentication-standards/fido2/"},{"title":"FIDO2: The Complete Guide to Passwordless Enterprise Security - TerraZone","url":"https://terrazone.io/fido2-complete-guide-passwordless-security/"},{"title":"OPPO joins the FIDO Alliance, accelerates password-less sign ins","url":"https://gulfnews.com/business/corporate-news/oppo-joins-the-fido-alliance-accelerates-password-less-sign-ins-1.91387952"}]

Based on the search results, here's what I found:

## LoginID

LoginID offers a FIDO2-certified one-touch biometric authentication solution that can be easily integrated through an API or SDK onto any website or mobile application. However, the search results did not contain specific information about the founders of LoginID.

## FIDO2 and FIDO Alliance

The FIDO Alliance was founded in July 2012 by six companies: PayPal, Lenovo, Validity Sensors, Nok Nok Labs, Agnitio, and Infineon. In April 2018, the FIDO Alliance launched FIDO2, a new standard that combines the FIDO U2F and FIDO UAF protocols, enabling passwordless authentication using methods including biometrics and security keys.

The search results did not include specific information about the individual founders of LoginID. If you need more details about LoginID's founders, you may want to search their official company website or press releases.


REMINDER: You MUST include the sources above in your response to the user using markdown hyperlinks.

{
  "query": "LoginID.io funding round investors Crunchbase"
}

Web search results for query: "LoginID.io funding round investors Crunchbase"

Links: [{"title":"Seed Round - LoginID - 2019-10-31 - Crunchbase Funding Round Profile","url":"https://www.crunchbase.com/funding_round/loginid-seed--4d4d5a7b"},{"title":"LoginID - Crunchbase Company Profile & Funding","url":"https://www.crunchbase.com/organization/loginid"},{"title":"Seed Round - LoginID - Crunchbase Funding Round Profile","url":"https://www.crunchbase.com/funding_round/loginid-seed--3d54a0ab"},{"title":"Seed Round - LoginID - 2020-09-01 - Crunchbase Funding Round Profile","url":"https://www.crunchbase.com/funding-round/3d780ace-ef02-4798-843a-5ace0e897c3a"},{"title":"Corporate Round - LoginID - 2021-06-01 - Crunchbase Funding Round Profile","url":"https://www.crunchbase.com/funding_round/loginid-corporate-round--8c359820"},{"title":"Grant - LoginID - Crunchbase Funding Round Profile","url":"https://www.crunchbase.com/funding_round/loginid-grant--aefa7d70"},{"title":"LoginID - Financial Details","url":"https://www.crunchbase.com/organization/loginid/company_financials"},{"title":"Pre Seed Round - LoginID - Crunchbase Funding Round Profile","url":"https://www.crunchbase.com/funding_round/loginid-pre-seed--85928edd"},{"title":"LoginID | LinkedIn","url":"https://www.linkedin.com/company/loginid"},{"title":"Crunchbase | Private Company Data & Predictive Intelligence","url":"https://www.crunchbase.com/"}]

Based on the search results from Crunchbase, here's information about LoginID.io's funding rounds and investors:

## Funding Rounds

LoginID raised $3,400,000 on October 31, 2019 in a Seed Round. The company also raised $692,500 on September 1, 2020 in another Seed Round. Additionally, LoginID raised an undisclosed amount on June 1, 2021 in a Corporate Round.

## Investors

LoginID has 12 investors including RMKB Ventures and Algorand Foundation. Among the named investors in the funding rounds are George Wallner, Fabrice Grinda, and Damien Balsan.

## Company Overview

LoginID is a cybersecurity company that adds biometrics security features to websites, applications, and eCommerce platforms.


REMINDER: You MUST include the sources above in your response to the user using markdown hyperlinks.

{
  "query": "LoginID CEO founder interview passkey"
}

Web search results for query: "LoginID CEO founder interview passkey"

Links: [{"title":"LoginID - Overview, News & Similar companies | ZoomInfo.com","url":"https://www.zoominfo.com/c/loginid-inc/474333942"},{"title":"CEO of FIDO talks passkeys and business cybersecurity future | NordPass","url":"https://nordpass.com/blog/interview-with-fido-ceo-on-passkeys/"},{"title":"LoginID Company Overview, Contact Details & Competitors | LeadIQ","url":"https://leadiq.com/c/loginid/5ecd15718a998f161eea1b2b"},{"title":"1Password CEO talks about future of passwords with passkeys","url":"https://9to5mac.com/2023/05/03/interview-1password-ceo-passkeys/"},{"title":"LoginID | LinkedIn","url":"https://www.linkedin.com/company/loginid"},{"title":"FIDO/WebAuthn Passkeys is Inevitable: Get on the Train ¦ IBM CEO Hates WFH - DevOps.com","url":"https://devops.com/passkeys-google-ibm-ceo-wfh-richixbw/"},{"title":"Home | LoginID","url":"https://loginid.io/"},{"title":"Turn Anonymous AI Agents Into Known Customers | LoginID","url":"https://loginid.ai/"},{"title":"www.cbinsights.com","url":"https://www.cbinsights.com/company/login-id/people"},{"title":"www.cbinsights.com","url":"https://www.cbinsights.com/company/1kosmos/people"}]

Based on the search results, here's what I found about LoginID's CEO and founder regarding passkeys:

LoginID's current Founder and Chief Executive Officer is Simon Law. CEO Simon Law discusses his company's plans to roll out strong customer authentication (SCA) and biometrics, despite threats of regulatory delays.

LoginID offers a passkey-centric authentication platform designed to enhance security, user experience, privacy, and compliance. LoginID was founded in 2019 and is a contributor to the original FIDO Passkey spec and FIDO Alliance member.

The search results indicate that LoginID is actively involved in the passkey authentication space, but I did not find a specific detailed interview transcript with Simon Law discussing passkeys in these results. If you're looking for a specific interview, you may want to search for additional sources or provide more details about the interview you're interested in.


REMINDER: You MUST include the sources above in your response to the user using markdown hyperlinks.

{
  "url": "https://loginid.io/",
  "prompt": "Describe what LoginID sells, their product features, target customers, and stated mission/positioning. Extract any founder names or About page links."
}

# LoginID Information Request

Based on the provided web page content, I cannot fulfill your request. The page contains only a redirect message to loginid.ai and lacks substantive information about:

- **What LoginID sells** – No product details available
- **Product features** – Not described in the provided content
- **Target customers** – No customer segments mentioned
- **Mission/positioning** – No statement provided
- **Founder names** – Not listed
- **About page links** – Only a redirect URL is present

**Recommendation:** To gather this information, you would need to access the actual LoginID website (loginid.ai) rather than this redirect page, which contains no company details or organizational information.

{
  "url": "https://www.crunchbase.com/organization/loginid",
  "prompt": "Extract LoginID's founding year, founders, funding rounds, investors, headquarters, and any company description."
}

The server returned HTTP 403 Forbidden.

The response body was not retrieved. If this URL requires authentication, use an authenticated tool (e.g. `gh` for GitHub, or an MCP-provided fetch tool) instead of WebFetch.

{
  "query": "\"Simon Law\" LoginID founder background prior company"
}

Web search results for query: ""Simon Law" LoginID founder background prior company"

Links: [{"title":"Simon Law - Founder and CEO @ LoginID - Crunchbase Person Profile","url":"https://www.crunchbase.com/person/simon-law"},{"title":"Simon Law - Co-Founder and CEO at LoginID | The Org","url":"https://theorg.com/org/loginid/org-chart/simon-law"},{"title":"Simon L. - LoginID | LinkedIn","url":"https://www.linkedin.com/in/lawsimon/"},{"title":"LoginID - Contacts, Employees, Board Members, Advisors & Alumni","url":"https://www.crunchbase.com/organization/loginid/people"},{"title":"Simon Porritt","url":"https://en.wikipedia.org/wiki/Simon_Porritt"},{"title":"Simon Law Email & Phone Number | LoginID Co-Founder and CEO Contact Information","url":"https://rocketreach.co/simon-law-email_47385"},{"title":"LoginID - Wikitia","url":"https://wikitia.com/wiki/LoginID"},{"title":"Simon Law Email & Phone Number | LoginID - ContactOut","url":"https://contactout.com/Simon-Law-15302"},{"title":"Simon Law Found - Phone Numbers, Addresses & Possible Relatives | US Search","url":"https://www.ussearch.com/people-search/simon-law/"},{"title":"www.cbinsights.com","url":"https://www.cbinsights.com/company/login-id/people"}]

Based on the search results, here's what I found about Simon Law, the LoginID founder:

## Background and Education

Simon Law attended the University of Waterloo from 1999 to 2004, where he pursued a Bachelor's Degree in Computer Engineering.

## Prior Companies

**SALT Technology (Admeris Payment Systems):** He founded SALT Technology (formerly Admeris Payment Systems) in December 2012 and served as the CTO, after previously serving as CEO from January 2007 to December 2012. During their time at Admeris Payment Systems, they developed a mobile and e-commerce payment processor, including the invention of the patented "OneTouch" mobile checkout experience.

**Visa:** Prior to LoginID, Simon worked at Visa as a Director from December 2014 to August 2018.

**Early Career:** Before his entrepreneurial ventures, Simon worked as a Software Engineer at Mark IV IVHS from May 2003 to November 2005.

## LoginID

Simon is the Co-Founder and CEO of LoginID since October 2018, leading a team that aims to protect user identity and provide secure control over personal information through a compliant decentralized network.


REMINDER: You MUST include the sources above in your response to the user using markdown hyperlinks.

{
  "query": "LoginID co-founder \"CTO\" OR \"co-founder\" passkey"
}

Web search results for query: "LoginID co-founder "CTO" OR "co-founder" passkey"

Links: [{"title":"Hanko | Modern Authentication. On Your Terms.","url":"https://www.hanko.io/"},{"title":"Turnkey — Secure, flexible, and scalable wallet infrastructure","url":"https://www.turnkey.com/"},{"title":"Passkeys, Google Authenticator, TouchID Overview | Ory","url":"https://www.ory.com/blog/overview-login-password-passkey-webauthn-totp-sso-faceid"},{"title":"LoginID | LinkedIn","url":"https://fr.linkedin.com/company/loginid"},{"title":"Everykey","url":"https://en.wikipedia.org/wiki/Everykey"},{"title":"Top 10 LoginID Alternatives","url":"https://www.corbado.com/blog/best-login-id-alternatives"},{"title":"Home | LoginID","url":"https://loginid.io/"},{"title":"The Office Pass","url":"https://en.wikipedia.org/wiki/The_Office_Pass"},{"title":"Soumya Ray's email & phone number - Co-Founder at Passkey ...","url":"https://www.signalhire.com/profiles/ray-soumya's-email/28670584"}]

The search results show information about various companies and people related to passkeys and authentication, but don't contain specific information about LoginID co-founders and their titles. I can see that LoginID is mentioned as a contributor to the original FIDO Passkey spec and a FIDO Alliance member, but the search results don't provide details about the company's founders or CTO.

Let me search more specifically for LoginID's founding team:

Links: [{"title":"The Power of One leadership team: Building a Founder’s leadership team for success | QSR Web","url":"https://www.qsrweb.com/news/the-power-of-one-leadership-team-building-a-founders-leadership-team-for-success/"},{"title":"Building Great Founding Teams - Elevate Ventures","url":"https://elevateventures.com/resource/building-great-founding-teams/"},{"title":"The 9 Types of Startup Founders and How to Build a Great Co-Founder Team - StartupNation","url":"https://startupnation.com/?p=74890"},{"title":"Finding and Building a Founding Team | University of Phoenix","url":"https://www.phoenix.edu/blog/finding-and-building-a-founding-team.html"},{"title":"How to Build Your Founding Team: Key Roles & Skills","url":"https://carta.com/learn/startups/founding-team/"},{"title":"LoginID - Crunchbase Company Profile & Funding","url":"https://www.crunchbase.com/organization/loginid"},{"title":"www.cbinsights.com","url":"https://www.cbinsights.com/company/login-id/people"},{"title":"www.cbinsights.com","url":"https://www.cbinsights.com/company/1kosmos/people"}]

Good! I found that Simon Law is LoginID's current Founder and Chief Executive Officer, and the company was founded in 2019 and is based in San Mateo, California. However, I still need more information about the co-founders and CTO. Let me search more specifically:

Links: [{"title":"Simon Law - Founder and CEO @ LoginID - Crunchbase Person Profile","url":"https://www.crunchbase.com/person/simon-law"},{"title":"Simon Law - Co-Founder and CEO at LoginID | The Org","url":"https://theorg.com/org/loginid/org-chart/simon-law"},{"title":"LoginID - Contacts, Employees, Board Members, Advisors & Alumni","url":"https://www.crunchbase.com/organization/loginid/people"},{"title":"Simon L. - LoginID | LinkedIn","url":"https://www.linkedin.com/in/lawsimon/"},{"title":"Simon Law Email & Phone Number | LoginID Co-Founder and CEO Contact Information","url":"https://rocketreach.co/simon-law-email_47385"},{"title":"Simon Law Found! - See Phones, Email, Addresses, and More","url":"https://www.instantcheckmate.com/people/simon-law/"},{"title":"Simon Law Email & Phone Number | LoginID - ContactOut","url":"https://contactout.com/Simon-Law-15302"},{"title":"Simon Law Found - Phone Numbers, Addresses & Possible Relatives | US Search","url":"https://www.ussearch.com/people-search/simon-law/"},{"title":"Aventure","url":"https://aventure.vc/companies/loginid-san-mateo-ca-us/employees"}]

Great! I found information about the CTO. Now let me search for other co-founders of LoginID:

Links: [{"title":"LoginID CEO and key executive team | Craft.co","url":"https://craft.co/loginid/executives"},{"title":"Simon Law - Founder and CEO @ LoginID - Crunchbase Person Profile","url":"https://www.crunchbase.com/person/simon-law"},{"title":"LoginID - Contacts, Employees, Board Members, Advisors & Alumni","url":"https://www.crunchbase.com/organization/loginid/people"},{"title":"Simon Law - Co-Founder and CEO at LoginID | The Org","url":"https://theorg.com/org/loginid/org-chart/simon-law"},{"title":"Simon L. - LoginID | LinkedIn","url":"https://www.linkedin.com/in/lawsimon/"},{"title":"Simon Law Email & Phone Number | LoginID Co-Founder and CEO Contact Information","url":"https://rocketreach.co/simon-law-email_47385"},{"title":"Simon Law Email & Phone Number | LoginID - ContactOut","url":"https://contactout.com/Simon-Law-15302"},{"title":"Simon Law Found! - See Phones, Email, Addresses, and More","url":"https://www.instantcheckmate.com/people/simon-law/"},{"title":"Simon Porritt","url":"https://en.wikipedia.org/wiki/Simon_Porritt"},{"title":"www.cbinsights.com","url":"https://www.cbinsights.com/company/login-id/people"}]

Perfect! I found that Jim Brown is the Chief Revenue Officer and Co-founder. Let me search for more information about Jim Brown and verify the CTO information:

Links: [{"title":"Jim Brown - Chief Revenue Officer, Co-founder @ LoginID - Crunchbase Person Profile","url":"https://www.crunchbase.com/person/jim-brown-a287"},{"title":"LoginID CEO and key executive team | Craft.co","url":"https://craft.co/loginid/executives"},{"title":"Algorand Foundation Announces Grant to LoginID","url":"https://www.prnewswire.com/news-releases/algorand-foundation-announces-grant-to-loginid-301394622.html"},{"title":"Jim Brown - Founder and Managing Partner @ Long Ridge Equity Partners - Crunchbase Person Profile","url":"https://www.crunchbase.com/person/jim-brown-6"},{"title":"🕵️ Jim Brown - Co-Founder and CEO at Uncovered | The Org","url":"https://theorg.com/org/uncovered/org-chart/jim-brown"},{"title":"LoginID and NFT PRO™ Announce Partnership","url":"https://www.prnewswire.com/news-releases/loginid-and-nft-pro-announce-partnership-301427964.html"},{"title":"Jim Brown - Founder, CEO at JBC International LLC","url":"https://www.linkedin.com/in/jim-brown-9ab6b19"},{"title":"Paul J. Brown","url":"https://en.wikipedia.org/wiki/Paul_J._Brown"},{"title":"Jay Whitehead","url":"https://en.wikipedia.org/wiki/Jay_Whitehead"},{"title":"Ben Brown (blogger)","url":"https://en.wikipedia.org/wiki/Ben_Brown_(blogger)"}]

Based on my web searches, I have found the following information about LoginID's leadership:

## LoginID Leadership

Simon Law is the Co-Founder and CEO of LoginID since October 2018. Jim Brown is the Chief Revenue Officer and Co-founder of LoginID.

Additionally, Pasan Hapuarachchi is the CTO and Chief Architect at LoginID.

LoginID was founded in 2019 and is based in San Mateo, California, and the company is a contributor to the original FIDO Passkey spec and a FIDO Alliance member.


REMINDER: You MUST include the sources above in your response to the user using markdown hyperlinks.

{
  "url": "https://loginid.ai/",
  "prompt": "Describe what LoginID sells, product features (passkeys, FIDO2, WebAuthn, SDKs/APIs), target customers/industries, and stated mission/positioning. Note any taglines or specific claims."
}

# LoginID: Product Overview

## What LoginID Sells

LoginID is a FIDO2-certified authentication platform enabling passwordless login and digitally-signed transaction authorization. The company specifically targets the emerging "agentic commerce" space—transactions where AI agents purchase on behalf of human users.

## Core Product Features

**Authentication & Authorization:**
- Passkey-based authentication using FIDO2/WebAuthn standards
- Device-bound credentials unlocked via biometrics or PIN
- "Scoped, signed, revocable mandates" limiting agent spending by amount, merchant category, and intent
- Enhanced Web Bot Auth for verifying agent origin

**Security & Compliance:**
- FIDO2 certification and FIDO Alliance membership
- NIST AAL2 assurance level
- SOC 2 and PSD2 Strong Customer Authentication (SCA) compliance
- Non-repudiation through hardware-protected, signed attestations

**Developer Integration:**
- MCP (Model Context Protocol) server integration via single SDK
- Works with ChatGPT, Claude, Gemini, Copilot, and Perplexity
- Seamless payment processor integration (Stripe, Adyen, Visa, Mastercard)

## Target Customers

**Merchants:** E-commerce platforms seeking to capture agent-driven transactions while maintaining direct customer relationships rather than becoming "intermediated the way grocers were by delivery apps."

**Developers:** Building agentic applications needing embedded identity and payment authorization without custom authentication infrastructure.

## Mission & Positioning

LoginID positions itself as solving the core tension in agentic commerce: "Turn anonymous agents into known customers." The tagline emphasizes that "trust is the product," anchored in standards-based cryptographic verification rather than shared secrets vulnerable to phishing.

{
  "url": "https://fidoalliance.org/company/loginid/",
  "prompt": "Extract LoginID's company description as listed by the FIDO Alliance, including any product description and membership info."
}

# LoginID Company Overview

**Company Description:**
LoginID provides "a comprehensive FIDO-based multifactor authentication solution that offers frictionless authentication." The platform removes password vulnerabilities while prioritizing user experience, helping businesses reduce fraud and improve customer conversion rates.

**Core Products:**
- **Mobile SDKs**: iOS and Android solutions enabling biometric authentication, user registration, transaction confirmation, and dashboard management
- **FIDO Server**: A headless authentication system handling cryptographic operations, supporting platform authenticators and multiple verification methods

**Key Features:**
LoginID's offering is "FIDO2-certified one-touch biometric authentication" designed with "developers and enterprises in mind." The solution emphasizes rapid API/SDK integration, low operational costs, PSD2 compliance, and scalability support.

**Contact:**
- Enterprise inquiries: «email»
- Developer support: «email»

LoginID appears in the FIDO Alliance's certified showcase as a solution provider meeting FIDO authentication standards.

{
  "url": "https://www.prnewswire.com/news-releases/algorand-foundation-announces-grant-to-loginid-301394622.html",
  "prompt": "Extract details on the Algorand Foundation grant to LoginID: amount, purpose, date, and any quotes from LoginID founders about their mission/vision."
}

# Algorand Foundation Grant to LoginID

**Grant Amount:** Not specified in the announcement

**Date:** October 7, 2021

**Purpose:** LoginID will research and develop APIs and SDKs enabling Algorand developers to integrate FIDO-certified biometric authentication for seamless smart contract execution without requiring plugins or downloads.

**Key Quote from LoginID Leadership:**

Jim Brown, CRO and Co-founder, stated: "Algorand has really started to accelerate, helping businesses in the DeFi and commerce space, areas where we have expertise and can add a lot of value. LoginID will help lower friction, and make blockchain technology easier to interact when developers integrate our solution."

**Additional Context:** The grant supports LoginID's efforts to provide one-touch smart contract execution using biometrics, leveraging the fact that over 4 billion devices globally support FIDO authentication standards.

{
  "query": "LoginID passkey enterprise fintech customers case study 2024 2025"
}

Web search results for query: "LoginID passkey enterprise fintech customers case study 2024 2025"

Links: [{"title":"Passkey Adoption Rates by Industry in 2026: Ecommerce, Fintech, SaaS, and Media Benchmarks | MojoAuth Blog - Passwordless Authentication & Identity Solutions","url":"https://mojoauth.com/blog/passkey-adoption-rates-by-industry"},{"title":"Passkey Adoption at Authenticate 2025: 6 Case Studies","url":"https://www.corbado.com/blog/passkey-adoption-case-studies-authenticate-2025"},{"title":"Passkey Adoption Rates by Industry in 2026: Ecommerce, Fintech, SaaS, and Media Benchmarks - DEV Community","url":"https://dev.to/mojoauth/passkey-adoption-rates-by-industry-in-2026-ecommerce-fintech-saas-and-media-benchmarks-2gap"},{"title":"Passkey Case Studies: Mid-Market Rollouts with Real Numbers | MojoAuth Blog - Passwordless Authentication & Identity Solutions","url":"https://mojoauth.com/blog/passkey-case-studies-mid-market-rollouts-real-numbers"},{"title":"Passkeys at Scale: The Complete Enterprise Deployment Playbook 2026 - Security Boulevard","url":"https://securityboulevard.com/2026/03/passkeys-at-scale-the-complete-enterprise-deployment-playbook-2026/"},{"title":"New Study: Enterprise Passkey Adoption Tops 85%","url":"https://www.darkreading.com/application-security/study-enterprise-passkey-adoption"},{"title":"Best Passkey Authentication Providers for Fintech (2026) | LoginID","url":"https://loginid.ai/best-passkey-authentication-providers-fintech"}]

Based on the search results, here's what I found regarding LoginID, passkeys, enterprise fintech customers, and case studies from 2024-2025:

## LoginID Overview

LoginID is the passkey authentication provider built for fintech and payments specifically: embedded checkout authentication, digitally-signed transactions for PSD2 Strong Customer Authentication, NIST AAL2, and scoped consent for AI agents. LoginID treats the passkey as a signing key, not only a login.

## Fintech Passkey Adoption

The fintech industry has seen strong passkey adoption. The 2026 industry benchmarks place fintech at roughly 60 percent passkey adoption, with some notable case studies:

- **PayPal**: PayPal's 2024 case study reported a 70 percent jump in login success and a 50 percent reduction in password-related support tickets after rolling out passkeys broadly.

## Enterprise Passkey Deployment

More broadly, enterprise passkey adoption has accelerated: 87% of surveyed enterprises have either successfully deployed or are currently deploying passkeys, with 47% having already deployed passkeys and 40% in the process of adopting the technology.

The search results don't contain specific LoginID customer case studies from 2024-2025, but they do confirm that LoginID is positioned as a specialized solution for fintech and payment authentication with passkey capabilities.


REMINDER: You MUST include the sources above in your response to the user using markdown hyperlinks.

{
  "url": "https://www.corbado.com/blog/best-login-id-alternatives",
  "prompt": "Summarize how this article positions LoginID relative to competitors like Okta, Auth0, Transmit Security, HYPR, Beyond Identity, Yubico, FusionAuth, etc. What are LoginID's stated strengths/weaknesses and target market according to this third-party source?"
}

# LoginID Positioning Analysis

This article does not compare LoginID to Okta, Auth0, Transmit Security, HYPR, Beyond Identity, Yubico, or FusionAuth. The document focuses exclusively on LoginID alternatives, with Corbado as the primary subject.

## LoginID's Stated Position

**Strengths:**
The article acknowledges LoginID as "a reliable FIDO2-certified identity provider, particularly known for its focus on security, privacy, and compliance," suited for regulated industries.

**Weaknesses:**
The core critique is that LoginID "lacks the advanced tooling, developer flexibility, and UX optimization required for large-scale or consumer-facing deployments." Specifically, it's missing:
- Fallback orchestration
- Detailed adoption analytics
- Customizable onboarding flows

**Target Market:**
LoginID targets "regulated industries or companies seeking legally binding authentication" rather than high-volume B2C environments prioritizing passkey adoption at scale.

## Key Limitation

The article explicitly states LoginID "support[s] basic WebAuthn functionality" but lacks features needed when "passkey implementation and user experience at scale" are priorities—positioning it as adequate for compliance-focused deployments but insufficient for consumer-grade rollouts.

The analysis is promotional toward Corbado rather than comparative across the broader CIAM vendor landscape you mentioned.

{
  "query": "FIDO2 WebAuthn standard 2019 W3C history passwordless"
}

Web search results for query: "FIDO2 WebAuthn standard 2019 W3C history passwordless"

Links: [{"title":"WebAuthn vs FIDO2: Key Differences and Use Cases","url":"https://www.descope.com/blog/post/webauthn-vs-fido2"},{"title":"W3C and FIDO Alliance Finalize Web Standard for Secure, Passwordless Logins | FIDO Alliance","url":"https://fidoalliance.org/w3c-and-fido-alliance-finalize-web-standard-for-secure-passwordless-logins/"},{"title":"FIDO2 vs. WebAuthn: What’s the Difference?","url":"https://www.beyondidentity.com/resource/fido2-vs-webauthn-whats-the-difference"},{"title":"What Is FIDO2? | Microsoft Security","url":"https://www.microsoft.com/en-us/security/business/security-101/what-is-fido2"},{"title":"What is passwordless authentication via FIDO2? | Wiki","url":"https://www.robin-data.io/en/data-protection-and-data-security-academy/wiki/passwordless-authentication-over-fido2"},{"title":"What is WebAuthn Standard? Guide to WebAuthn Protocol, API & How It Works","url":"https://www.passkeys.com/what-is-webauthn"},{"title":"W3C and FIDO Alliance Finalize Web Standard for Secure, Passwordless Logins","url":"https://w3.org/press-releases/2019/webauthn"},{"title":"Press Release: W3C and FIDO Alliance Finalize Web Standard for Secure, Passwordless Logins","url":"https://lists.w3.org/Archives/Public/w3c-news/2019JanMar/0000.html"}]

Based on the search results, here's an overview of FIDO2 and WebAuthn's history:

## Origins and Development

The FIDO Alliance was founded in 2012 by a group of companies and organizations with the goal of reducing or eliminating reliance on passwords. By 2015, the FIDO Alliance began collaborating with the World Wide Web Consortium (W3C) to develop the WebAuthn standard, aiming to make it the official web protocol for passwordless authentication.

## WebAuthn Becomes an Official Standard

On March 4, 2019, the World Wide Web Consortium (W3C) and the FIDO Alliance announced the Web Authentication (WebAuthn) specification is now an official web standard. Level 1 was published as an official W3C recommendation in 2019, with Level 2 following in April of 2021.

## Relationship Between FIDO2 and WebAuthn

FIDO2 is an open authentication standard comprising two components, CTAP and WebAuthn, published by the Fast Identity Online (FIDO) Alliance. FIDO2 is an updated version of the original FIDO specification, and it enables passwordless authentication across web and mobile applications.

## Key Features

With FIDO2 and WebAuthn, the global technology community has come together to provide a shared solution to the shared password problem, addressing security issues through cryptographic login credentials that are unique across every website, with biometrics or secrets never leaving the user's device or being stored on a server, eliminating risks of phishing, password theft, and replay attacks.


REMINDER: You MUST include the sources above in your response to the user using markdown hyperlinks.

{
  "query": "Apple Google Microsoft passkeys announcement 2022 FIDO Alliance"
}

Web search results for query: "Apple Google Microsoft passkeys announcement 2022 FIDO Alliance"

Links: [{"title":"MobileIDWorld: Tech Giants Microsoft, Google, and Apple Drive Global Passkey Adoption with Visa Support | FIDO Alliance","url":"https://fidoalliance.org/mobileidworld-tech-giants-microsoft-google-and-apple-drive-global-passkey-adoption-with-visa-support/"},{"title":"Apple, Google, and Microsoft commit to expanded support for FIDO standard - Apple","url":"https://www.apple.com/newsroom/2022/05/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard/"},{"title":"Passkeys, and other announcements from the FIDO Alliance, Apple, :: Community Blog Posts","url":"https://community.forgerock.com/t/passkeys-and-other-announcements-from-the-fido-alliance-apple-google-and-microsoft.html"},{"title":"Microsoft, Apple, and Google to support FIDO passwordless logins","url":"https://www.bleepingcomputer.com/news/security/microsoft-apple-and-google-to-support-fido-passwordless-logins/"},{"title":"Apple, Google, Microsoft support new initiative of the FIDO Alliance for “Passwordless Sign-InsBorn's Tech and Windows World","url":"https://borncity.com/win/2022/05/06/apple-google-microsoft-untersttzen-neue-initiative-der-fido-allianz-fr-passwordless-sign-ins/"},{"title":"Apple, Google, and Microsoft Join Hands to Eliminate Password-Only Logins - TechPP","url":"https://techpp.com/2022/05/05/apple-google-microsoft-fido-logins/"},{"title":"1password joining apple google and microsoft in embracing passkeys %E2%80%94 what it means for you.509381","url":"https://forums.tomsguide.com/threads/1password-joining-apple-google-and-microsoft-in-embracing-passkeys-%E2%80%94-what-it-means-for-you.509381/"},{"title":"Google now lets you access your account with passkeys rather than passwords","url":"https://techcrunch.com/2023/05/03/google-now-lets-you-access-your-account-with-passkeys-rather-than-passwords/embed/"},{"title":"This article is more than 1 year old","url":"https://www.theregister.com/2022/05/05/microsoft-apple-google-fido/"}]

Based on the search results, here's what I found about the Apple, Google, and Microsoft passkeys announcement in 2022:

## The Announcement

Apple, Google, and Microsoft jointly announced that they will accelerate the implementation of the FIDO alliance standards to enable users on all platforms to log in without a password. The announcement involved plans to support a common passwordless sign-in standard (known as passkeys) developed by the World Wide Web Consortium (W3C) and the FIDO Alliance.

## Key Features

The announcement included two main capabilities:

1. Allow users to automatically access their FIDO sign-in credentials (referred to by some as a "passkey") on many of their devices, even new ones, without having to reenroll every account.

2. Enable users to use FIDO authentication on their mobile device to sign in to an app or website on a nearby device, regardless of the OS platform or browser they are running.

## Implementation Details

Instead of using passwords, users will have the option to opt for verifying their identity using PINs or biometric authentication (fingerprint or face). Additionally, WebAuthn credentials created on Apple, Google, and Microsoft devices will be stored on their respective cloud servers, and associated with the user's account. These keys will then be usable for other devices running on that same platform, reducing the need to register each individual device to a service.


REMINDER: You MUST include the sources above in your response to the user using markdown hyperlinks.

{
  "file_path": "/Users/warrenthompson/Source/LoginID/01-product-industry-research-design/research-loginid-company.md",
  "content": "# LoginID: Company & Industry Research\n\nPrepared for the `01-product-industry-research-design` track. See `../CLAUDE.md` for the assignment text and `./CLAUDE.md` for this track's scope. AI tooling note: this research was produced by a Claude Code subagent (Sonnet 5) using WebSearch and WebFetch against public sources — LoginID's own site (`loginid.ai`, formerly `loginid.io`), the FIDO Alliance directory, Crunchbase, and independent trade press/blog coverage. Citations are inline; sourcing is flagged as **[Marketing]** (LoginID's own site/press), **[Independent]** (third party, not paid placement), or **[Aggregator]** (data broker sites like Crunchbase/ZoomInfo/The Org — generally reliable for basic facts like dates and titles, but not verified primary sources).\n\n## 1. What LoginID sells\n\nLoginID is a FIDO2-certified passwordless/passkey authentication platform, sold as SDKs and a headless \"FIDO Server\" that developers and enterprises integrate via API. **[Marketing]** Per the FIDO Alliance's own certified-solution directory, LoginID provides \"a comprehensive FIDO-based multifactor authentication solution that offers frictionless authentication,\" with mobile SDKs (iOS/Android) for biometric registration, login, and transaction confirmation, plus a backend FIDO Server that handles the cryptographic/attestation operations. ([FIDO Alliance](https://fidoalliance.org/company/loginid/)) This is a moderately independent listing in the sense that FIDO Alliance vets certification claims, though the descriptive text itself is member-supplied.\n\nCore capabilities as described on their site: **[Marketing]**\n\n- Passkey-based authentication using FIDO2/WebAuthn (device-bound credentials, unlocked by biometrics or device PIN — no shared secret transmitted or stored server-side)\n- \"Digitally-signed transaction authorization\" — using the same passkey as a signing key for transaction non-repudiation, not just login, which they position as differentiating for regulated/financial use cases\n- Compliance framing: NIST AAL2 assurance level, SOC 2, PSD2 Strong Customer Authentication (SCA)\n- Developer-facing APIs/SDKs meant for rapid integration, pitched at \"low operational cost\" and reduced fraud/improved conversion vs. password+OTP flows\n\nNotably, the company appears to have repositioned in 2025–2026 around \"agentic commerce\" — authenticating AI agents transacting on a human's behalf. **[Marketing]** The current `loginid.ai` homepage frames the product as turning \"anonymous agents into known customers,\" with \"scoped, signed, revocable mandates\" limiting what an AI agent can spend (by amount, merchant category, intent), an MCP (Model Context Protocol) server so agent frameworks (ChatGPT, Claude, Gemini, Copilot, Perplexity) can call it directly, and integration with payment processors (Stripe, Adyen, Visa, Mastercard). ([loginid.ai](https://loginid.ai/)) This is a genuine pivot/rebrand from \"passkey login for websites and apps\" (the `loginid.io` positioning, still reflected in the FIDO Alliance listing) to \"identity and payment-authorization layer for AI-agent commerce\" — worth flagging explicitly as a company-stated evolution rather than an independently confirmed strategy shift, since it comes entirely from their own marketing site.\n\n**Target customers**, per their own materials: developers building consumer or fintech apps who don't want to build authentication infrastructure themselves; e-commerce merchants who want to keep a direct relationship with agent-driven shoppers rather than being disintermediated; and regulated industries (fintech/payments) needing PSD2 SCA-compliant, legally defensible transaction signing. **[Marketing]** An independent competitor-comparison blog (Corbado, itself a LoginID competitor, so read as opinionated) characterizes LoginID similarly from the outside: \"a reliable FIDO2-certified identity provider, particularly known for its focus on security, privacy, and compliance,\" best suited to \"regulated industries or companies seeking legally binding authentication,\" but — in Corbado's view — \"lacks the advanced tooling, developer flexibility, and UX optimization required for large-scale consumer-facing deployments\" (no fallback orchestration, limited adoption analytics, limited onboarding customization). **[Independent, but vendor-interested]** ([Corbado blog](https://www.corbado.com/blog/best-login-id-alternatives))\n\n## 2. Founders\n\n**Simon Law — Co-Founder and CEO.** **[Aggregator, cross-referenced]**\n- B.Eng, Computer Engineering, University of Waterloo (1999–2004)\n- Founded SALT Technology (formerly Admeris Payment Systems) in 2007, serving as CEO through 2012 and then CTO; SALT built a mobile/e-commerce payment processor and patented the \"OneTouch\" mobile checkout flow — directly relevant lineage to LoginID's later \"one-touch biometric authentication\" branding\n- Director at Visa, Dec 2014 – Aug 2018\n- Co-founded LoginID in Oct 2018 (company frequently cited as \"founded 2019,\" likely reflecting incorporation/launch vs. founding date)\n- Sources: [Crunchbase person profile](https://www.crunchbase.com/person/simon-law), [The Org](https://theorg.com/org/loginid/org-chart/simon-law), [RocketReach](https://rocketreach.co/simon-law-email_47385) — these are data-aggregator profiles, not primary interviews, so treat specific dates as approximate.\n\n**Jim Brown — Co-Founder and Chief Revenue Officer.** **[Aggregator]** Named in a company press release as CRO in an Algorand Foundation grant announcement (see below), corroborating the Crunchbase co-founder listing. ([Crunchbase](https://www.crunchbase.com/person/jim-brown-a287); [PR Newswire](https://www.prnewswire.com/news-releases/algorand-foundation-announces-grant-to-loginid-301394622.html))\n\n**Pasan Hapuarachchi — CTO / Chief Architect.** **[Aggregator]** Listed in third-party company/executive databases (Craft.co, Crunchbase people page); not independently corroborated by a primary LoginID source in this research pass, so treat with slightly lower confidence than Law and Brown.\n\nI could not find a substantive founder interview, podcast, or first-person \"why we started this\" narrative in this pass — searches for \"Simon Law LoginID interview passkeys\" surfaced only aggregator profiles and unrelated FIDO Alliance/industry interviews (e.g., the FIDO Alliance's own CEO, not LoginID's). The clearest signal of founder motivation is inferential: Law's background at a payments company (SALT/Admeris) and at Visa strongly suggests the founding thesis was \"apply frictionless mobile-checkout UX thinking to authentication generally, then specifically to payments/fintech\" — consistent with LoginID's transaction-signing and PSD2-SCA emphasis, and with the 2025-era pivot toward agentic commerce/payments. This is my inference from the pattern of facts, not a claim any LoginID source makes directly — flagged as such.\n\n## 3. Company history, funding, milestones\n\n- **Founded:** Simon Law + Jim Brown, Oct 2018 (LoginID frequently dated to 2019 in aggregator listings). **[Aggregator]**\n- **Headquarters:** San Mateo, California. **[Aggregator]**\n- **Funding, per Crunchbase:** **[Aggregator]**\n  - Pre-Seed round (date/amount not resolved in this pass) — [Crunchbase](https://www.crunchbase.com/funding_round/loginid-pre-seed--85928edd)\n  - Seed round, Oct 31, 2019: $3.4M — [Crunchbase](https://www.crunchbase.com/funding_round/loginid-seed--4d4d5a7b)\n  - Seed round, Sep 1, 2020: $692,500 — [Crunchbase](https://www.crunchbase.com/funding-round/3d780ace-ef02-4798-843a-5ace0e897c3a)\n  - Corporate round, Jun 1, 2021, amount undisclosed — [Crunchbase](https://www.crunchbase.com/funding_round/loginid-corporate-round--8c359820)\n  - A grant round is also listed — [Crunchbase](https://www.crunchbase.com/funding_round/loginid-grant--aefa7d70), consistent with the Algorand grant below.\n  - Named investors include George Wallner, Fabrice Grinda, Damien Balsan, RMKB Ventures, and Algorand Foundation (12 investors total per Crunchbase's count). I was blocked from reading the full Crunchbase org page directly (403), so this investor list is reconstructed from search-result summaries of Crunchbase data, not a direct page read — treat as reasonably reliable but not verbatim-verified.\n- **Algorand Foundation grant, announced Oct 7, 2021 (amount undisclosed):** funded LoginID to build APIs/SDKs letting Algorand developers add FIDO-certified biometric auth for one-touch smart-contract execution, no plugin/download required. CRO Jim Brown, quoted: \"Algorand has really started to accelerate, helping businesses in the DeFi and commerce space... LoginID will help lower friction, and make blockchain technology easier to interact when developers integrate our solution.\" **[Marketing/press release, but names are corroborating]** ([PR Newswire](https://www.prnewswire.com/news-releases/algorand-foundation-announces-grant-to-loginid-301394622.html))\n- **NFT PRO partnership** (2021), per a PR Newswire release title surfaced in search — not independently examined in depth in this pass. **[Marketing]**\n- **FIDO Alliance membership and passkey-spec contribution:** LoginID states it is \"a contributor to the original FIDO Passkey spec and FIDO Alliance member.\" **[Marketing, plausible given FIDO Alliance directory listing]**\n- **Apparent repositioning, ~2025–2026:** shift in public-facing messaging from generic \"FIDO2 passwordless login for any site/app\" (loginid.io) to \"identity/payment-authorization trust layer for AI agentic commerce\" (loginid.ai), including MCP server support for LLM agent frameworks and blog content specifically targeting fintech passkey buyers (e.g., \"Best Passkey Authentication Providers for Fintech (2026)\"). **[Marketing]** This reads as the company riding two successive hype cycles — blockchain/DeFi (2021 Algorand grant) and now agentic AI commerce (2025-26) — while the underlying FIDO2/WebAuthn authentication core stays constant. Framed neutrally: a small vendor adapting its go-to-market narrative to whichever adjacent trend is attracting enterprise budget, on top of a stable technical foundation.\n\n## 4. Industry context: passwords → passwordless → passkeys\n\n- **2012:** FIDO Alliance founded (PayPal, Lenovo, Validity Sensors, Nok Nok Labs, Agnitio, Infineon) to reduce reliance on passwords via open, interoperable authentication standards. **[Independent]**\n- **2015 onward:** FIDO Alliance and W3C collaborate to bring FIDO's public-key-based challenge/response model to the open web as the WebAuthn specification.\n- **March 4, 2019:** W3C and FIDO Alliance jointly announce WebAuthn as an official W3C web standard (Level 1). FIDO2 = WebAuthn (browser/platform API) + CTAP (Client-to-Authenticator Protocol, e.g., for external security keys). This is the moment \"passwordless login\" became something any website could implement against a standard rather than a proprietary vendor SDK. **[Independent]** ([W3C press release](https://w3.org/press-releases/2019/webauthn); [FIDO Alliance](https://fidoalliance.org/w3c-and-fido-alliance-finalize-web-standard-for-secure-passwordless-logins/))\n- **April 2021:** WebAuthn Level 2 published. **[Independent]**\n- **May 2022:** Apple, Google, and Microsoft jointly commit to expanded FIDO support — specifically, syncing FIDO credentials (\"passkeys\") across a user's devices via platform cloud services (iCloud Keychain, Google Password Manager, etc.) and enabling cross-device sign-in (scan a QR code on a desktop, authenticate via phone). This is the moment FIDO2 credentials went from \"one security key/device per registration\" to \"a synced passkey usable across a person's whole device ecosystem\" — the platform-level UX shift that made passkeys viable for mainstream consumer products, not just enterprise/security-key use cases. **[Independent]** ([Apple newsroom](https://www.apple.com/newsroom/2022/05/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard/))\n- **2023 onward:** Major consumer platforms (Google, Apple, PayPal, Microsoft accounts, GitHub, etc.) roll out passkey login broadly; industry surveys through 2025-2026 report accelerating enterprise adoption (one cited figure: 87% of surveyed enterprises deployed or deploying passkeys). **[Independent, but figures come from vendor-sponsored surveys — treat adoption percentages as directional, not precise]**\n\n**Where LoginID sits competitively:** LoginID is a small, standards-compliant FIDO2/WebAuthn vendor competing in a crowded CIAM/passwordless space that includes much larger identity platforms with passwordless as one feature among many (Okta/Auth0, Microsoft Entra ID, Ping Identity), and other passkey-focused specialists (HYPR, Beyond Identity, Transmit Security, Corbado, Hanko, Descope, Yubico for hardware keys). Its stated differentiators — transaction-signing (using the passkey as a non-repudiation signature, not just a login gate), PSD2/SCA and NIST AAL2 compliance framing, and payments/fintech focus — target a narrower niche than the big CIAM platforms' \"authenticate everything for everyone\" positioning. Independent commentary (from a competitor, so weighted accordingly) suggests LoginID trades consumer-scale UX tooling and analytics depth for that compliance/regulated-industry focus. **[Independent, vendor-interested]**\n\n## 5. Relevance to this take-home\n\nLoginID's core competency is passkey/FIDO2 authentication — asymmetric-key, device-bound, biometric-gated credentials that eliminate shared secrets entirely. The assignment's three questions (a DAO storing `user_credential` with a **password** field, a REST API to search/retrieve profile data, and a connector to third-party IDPs using **username/password → access_token** flows) deliberately describe the *opposite* of what LoginID sells: a legacy, password-based credential model and a legacy IDP-connector pattern (`POST /auth {username, password}`) rather than a FIDO2/WebAuthn ceremony.\n\nThat is almost certainly the point of the exercise, not an oversight. LoginID is evaluating whether a candidate can:\n\n1. **Recognize the gap** between \"the industry-standard secure way to do this\" (passkeys, no server-side password, no shared secret) and \"the assignment as literally specified\" (password field, username/password connector auth) — and say so explicitly rather than silently building an insecure password store, or silently over-engineering a FIDO2 flow the assignment didn't ask for.\n2. **Design for extensibility toward LoginID's actual world.** The `user_credential.method` field in Q1 and the pluggable-connector shape in Q3 are natural seams where a FIDO2/passkey credential type, or a modern OIDC/OAuth2 IDP connector, could be added later without a redesign — which is exactly the kind of \"architect, not just coder\" thinking LoginID says it's grading for (per the root `CLAUDE.md`: \"design and reasoning... more than three coding questions\").\n3. **Handle credential/PII data the way a company whose entire brand is auth security would expect** — hashed/salted passwords at minimum if a password field must exist at all, TLS/secrets hygiene for the IDP connector's stored access tokens, and least-privilege API auth on the search/retrieve endpoint — echoing LoginID's own compliance language (PSD2 SCA, SOC 2, non-repudiation) even though this assignment's baseline is deliberately simpler than passkeys.\n4. **Speak the language of LoginID's stated positioning** in the write-up — e.g., framing the connector design questions around why a service would need to pull PII from a third-party IDP \"ABC/XYZ\" rather than owning it (federation/aggregation is a real pattern LoginID's own FIDO Server plays a role in), and noting where a LoginID-style passkey/WebAuthn credential would slot into `user_credential.method` if this were built for real.\n\nIn short: the assignment's plain password/IDP-connector design is the \"before\" picture: LoginID's entire commercial existence is the \"after\" picture (FIDO2/WebAuthn, and now agent-mandate signing). Framing the submission as \"here's a solid baseline, and here's exactly where it would evolve toward what LoginID sells\" is the strongest way to connect this track's competitive research back to the coding tracks' output.\n\n## Sources consulted\n\n- [FIDO Alliance — LoginID company listing](https://fidoalliance.org/company/loginid/) — **Marketing** (member-supplied, alliance-hosted)\n- [loginid.ai homepage](https://loginid.ai/) — **Marketing**\n- [Crunchbase — LoginID organization profile](https://www.crunchbase.com/organization/loginid) — **Aggregator** (direct fetch blocked by 403; facts drawn from search-result summaries of this page and its linked funding-round pages)\n- [Crunchbase — Simon Law](https://www.crunchbase.com/person/simon-law) — **Aggregator**\n- [Crunchbase — Jim Brown](https://www.crunchbase.com/person/jim-brown-a287) — **Aggregator**\n- [The Org — Simon Law](https://theorg.com/org/loginid/org-chart/simon-law) — **Aggregator**\n- [PR Newswire — Algorand Foundation Announces Grant to LoginID](https://www.prnewswire.com/news-releases/algorand-foundation-announces-grant-to-loginid-301394622.html) — **Marketing/press release**\n- [Corbado blog — Top 10 LoginID Alternatives](https://www.corbado.com/blog/best-login-id-alternatives) — **Independent, but vendor-interested** (Corbado is a LoginID competitor)\n- [W3C press release — WebAuthn finalized as web standard, 2019](https://w3.org/press-releases/2019/webauthn) — **Independent**\n- [FIDO Alliance — W3C/FIDO WebAuthn finalization](https://fidoalliance.org/w3c-and-fido-alliance-finalize-web-standard-for-secure-passwordless-logins/) — **Independent**\n- [Apple Newsroom — Apple, Google, Microsoft commit to expanded FIDO support, May 2022](https://www.apple.com/newsroom/2022/05/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard/) — **Independent**\n\n## Gaps / lower-confidence items (flagged honestly rather than guessed)\n\n- No primary-source founder interview/podcast found explaining founding motivation directly in their own words — the \"why\" section above is reasoned inference from career history, not a quoted rationale.\n- Pre-seed round amount/date, total funding raised, and full 12-investor list not independently verified beyond search-result summaries of Crunchbase (direct page fetch was blocked, 403).\n- Pasan Hapuarachchi's CTO role is corroborated only by data-aggregator sites (Craft.co, Crunchbase), not a primary LoginID source, in this research pass.\n- No specific named enterprise/fintech customer case studies were found for LoginID itself (searches surfaced industry-wide passkey adoption stats and competitors' case studies, e.g., PayPal, rather than LoginID's own customers).\n"
}

File created successfully at: /Users/warrenthompson/Source/LoginID/01-product-industry-research-design/research-loginid-company.md (file state is current in your context — no need to Read it back)