Strivacity Fusion

Consumer Identity and Access Management (CIAM) has emerged as a distinct specialty within IAM to address consumer-focused requirements: improving digital experiences, collecting richer consumer data, and using that data to drive sales opportunities and brand loyalty. CIAM platforms provision, authenticate, authorize, and store consumer identities across many domains, including government-to-citizen scenarios. Unlike workforce IAM, consumer data often originates from multiple unauthoritative sources and is reused for diverse purposes such as access decisions, marketing analytics, and compliance initiatives like AML. CIAM must operate at massive scale—millions of identities and potentially billions of daily transactions—making SaaS delivery an increasingly dominant model.

Regulatory and privacy pressures shape CIAM capabilities. Since GDPR (May 2018), explicit, unambiguous consent has become mandatory, pushing CIAM solutions to provide consent capture, user dashboards for data-sharing preferences, policy consistency, change notifications, and acknowledgement collection. Core CIAM feature areas include diverse authentication options (including risk-adaptive and continuous approaches), privacy/consent management, IoT identity association, identity analytics, broad API enablement, robust account recovery (with an explicit recommendation to avoid KBA), and account takeover protection using fraud and compromised-credential intelligence. Many vendors are shifting to “API-first” architectures aligned with micro-services and “Identity Fabrics,” creating opportunities for IT to partner closely with Marketing.

Strivacity (founded 2019, Virginia) offers Strivacity Fusion, a micro-services/serverless CIAM delivered on AWS with a multi-instance (not multi-tenant) approach and separate identity stores per customer to maximize data separation. Fusion supports white-label branding, progressive profiling, multiple registration and provisioning paths, extensive OTP/magic link authentication and recovery, default breached-password protections, botnet and TOR detection, and a risk engine for new-device and impossible-travel detection. Consent tooling supports user access, export (HTML/JSON), and deletion, with planned support for Kantara Consent Receipt. Fusion provides attribute normalization, bi-directional mapping with standards-based schemas, an embedded node.js IDE for customization, federation via OAuth/OIDC/SAML, API governance via OIDC client credentials, analytics dashboards, and connectors for major MarTech/ITSM tools, while noting roadmap gaps such as additional MFA methods, mobile SDK, FIDO2/WebAuthn, IoT identity, and expanded integrations.

• CIAM solutions may need to manage many millions of identities and process potentially billions of logins and other transactions per day.
• GDPR took effect in the EU in May of 2018 and requires clear and unambiguous consumer consent for data use.
• SaaS delivery for CIAM services is trending upwards and is likely to remain the default choice for most organizations.
• Strivacity was founded in 2019 and is headquartered in Virginia.
• Strivacity Fusion is hosted on Amazon AWS and uses a multi-instance approach rather than multi-tenant.
• Fusion provides separate identity data stores per customer to achieve maximum data separation.
• Fusion supports social registration from Facebook, GitHub, Google, Microsoft, and Twitter.
• Fusion supports OAuth, OIDC, and SAML for federation and SSO, and SAML configurations can be imported from XML files.
• Fusion lets consumers view, edit, download (HTML or JSON), and delete personal information.
• SOC 2 Type 2 certification is in work.

• “Unlike workforce IAM systems though, information about these consumers often arrives from many unauthoritative sources.”
• “Moreover, CIAM systems must be able to manage many millions of identities, and process potentially billions of logins and other transactions per day.”
• “Since GDPR took effect in the EU in May of 2018, collecting clear and unambiguous consent from consumers for the use of their data has become mandatory.”
• “Many CIAM vendors are taking an ‘API-first’ approach to CIAM.”
• “API-driven CIAM architectures may be considered Identity API platforms and are best when instantiated as micro-services.”
• “IT departments should welcome CIAM initiatives, as they provide an opportunity for IT, usually considered a cost center to closely team with Marketing, a revenue producing center.”
• “Strivacity adheres to the progressive profiling concept, whereby customers can obtain pertinent information from consumers as needed rather than trying to get complete profile information at registration time.”
• “Consent management is a paramount concern for many organizations.”
• “Strivacity adheres to the principle of data minimization.”
• “The mapping of claims and attributes works bi-directionally for syncing accounts with external identity providers as well, due to support for OASIS and OIDC standard schemas.”