Builders & Buyers: André Ferraz of Incognia on Turning a Hacker’s Mindset into a Mission, Building Global from Day One, and Redefining Digital Identity

Builders & Buyers is dedicated to showcasing leading figures in the fintech industry and their contributions. Through candid and in-depth conversations, Stifel Bank’s Managing Directors, Josh Dorsey and Jake Moseley, aim to connect audiences with the thought leaders driving the future of finance. The series will explore personal journeys, company building, investing strategies, and topical macroeconomic conditions.

Notes from Josh Dorsey, conversation moderator:

André Ferraz is the kind of founder who makes you stop and think a little deeper about the systems we rely on every day. We got to chat for this edition of Builders & Buyers, and the conversation took us everywhere, from hacking online multiplayer RPGs as a kid to building billion-device infrastructure and rethinking what identity really means in a digital world.

I already knew André was doing impressive work at Incognia. But after hearing his full story – how he grew up, how early exposure shaped his thinking, and how intentional he’s been about every step since – I feel even more inspired. What stood out most is how clear he is on what matters: trust, precision, long-term thinking, and never compromising along the way.

This conversation had it all – personal story, product vision, and some seriously mind-bending precision (yes, he really dropped a 99.99999% accuracy stat). Hope you enjoy it as much as I did.

---

Josh: Before we dive into the serious stuff, I have to ask about your hacker era. What kind of hacking were you doing back in the day, and what drew you into that world?

André: At first, it was just me experimenting on my own, trying to crack games and things like that. Once I succeeded for the first time, I thought, “Okay, this isn’t that hard.” From there, I started doing it more as a prank on my friends. We all used to play a lot of online multiplayer RPGs, so I would hack into their accounts, steal their in-game items, and then show off those items on my account. We had a fun time with it.

I was also active on messaging platforms like MSN and IRC. Interestingly, while it started out purely recreational, all of this helped me develop an intuition for security – how to find gaps and weak spots in security systems. Eventually, I started seeing those same patterns everywhere, not just in digital systems, but in physical security as well.

Your dad was a computer science professor, which meant you had early exposure to tech. Was that something he actively encouraged, or did you naturally gravitate toward it because it was around you?

I grew up in a city in northeast Brazil, which isn’t as developed as places like São Paulo or Rio. Thanks to my dad’s research, I was the first kid in my school to have a computer and internet access.

He taught me how to use the computer, and from there, I’d spend hours exploring on my own. Another major influence was that my dad did his PhD in the U.K., so I learned English at a young age. Since everything in computer science and programming is in English, it almost felt like a requirement to learn it. That made a huge difference and really accelerated my learning.

When I was studying computer science in college, my dad shared a 1991 paper by Mark Weiser, the chief scientist at Xerox PARC. It was titled The Computer for the 21st Century and completely reshaped my thoughts about technology. Weiser described a future where computers essentially disappear into the background. Technology becomes so embedded and intuitive that we don’t even notice it’s there. One quote really stuck with me: “The most sophisticated technologies are those that we don’t even perceive.”

I was fascinated. I kept thinking, “How can we create systems so intelligent and seamless that they just melt into everyday life?” That paper became a turning point, and it led me to start exploring geolocation technologies. I realized that if technology is going to truly understand and serve people in the moment, it has to understand context. And a huge part of understanding context is knowing where someone is.

For example, you walk into a restaurant. You need food. You choose food from a menu. Why can’t your phone recognize that and load the menu automatically without you having to ask or scan a QR code? Or, imagine you’re at an airport. Your phone already knows your flight, so why doesn’t it instantly show you the fastest route to your gate? That line of thinking is what really drove me to dive deep into geolocation.

We’ll come back to that, but I want to rewind for a moment. I’d love to hear more about your upbringing in Brazil. It sounds like that’s where your journey with computers really began.

Definitely. I was 12 years old. Back then, Brazil wasn’t as dangerous as it is today. I spent a lot of time outside, playing soccer in the streets, riding bikes with friends. But one day, I was riding my bike when a guy approached me, pointed a gun in my face, and stole my bike. It was completely unnecessary – I was just a 12-year-old kid on a bike – but it was such a traumatic experience, and I remember thinking, “I need to fight crime.” Later, I realized I could do that not just in the physical world, but in the digital one too. It might not be as dramatic, but as money and systems move online, so does crime.

That was a big moment for me in deciding what I wanted to do with my life.

That’s intense – it clearly had a significant impact on your path. Fast forward to today: when you think about the startup environment in Brazil, do you see ambition as something shaped by that environment or more as an internal trait?

There are a couple of different layers to this. First, Brazil is a big market, but not as big as the U.S. and not as small as a place like Israel. In Israel, the small domestic market forces founders to think globally from day one. In Brazil, you can build a sizable, successful business just by focusing locally. For many founders, that’s enough. But it’s a very different mindset from creating a global tech company.

The second layer is cultural. In Brazil, there’s a strong narrative that entrepreneurs are the enemy of society, like they’re extracting value and taking advantage. Here, in the U.S., it’s the opposite. Entrepreneurs are often seen as heroes. People want to be entrepreneurs.

Those are the two main differences I see between starting a business here in the U.S. versus in Brazil. Once you’ve experienced both environments, the difference is really clear, and it’s actually why I moved to the U.S. I wanted to build a global business. With my previous company, which was in the location-based marketing space, we were market leaders in Brazil. It was a strong business: profitable, healthy, and fairly large. But just a couple of months before the pandemic hit and right before our pivot, Google and Facebook launched very similar products.

That was when we realized: “We’re probably not going to survive this.”

The crash only accelerated what was already coming. We likely would’ve had to pivot anyway, but it would’ve been a slower, more painful process. That experience taught me something important: if you’re in software, which is inherently global, and you don’t win in the U.S., the largest and most competitive market, then eventually whoever does win here will expand into your territory. And when that happens, it’s nearly impossible to compete.

I didn’t want to go through that again. I wanted to build something global from day one. That led me to move to the U.S. and, ultimately, to where I am now.

Let’s now talk about your company, Incognia.

Identity is a massive, still-unresolved problem online. There’s no universal standard for what a “user” or “person” means online, and there’s no clear line between a bot and a real human behind a device. So, that’s the broader issue we’re trying to solve at Incognia: redefining identity for the digital world. More specifically, we’re trying to build a solution that’s truly universal and agnostic to device or technology.

The core principle behind Incognia is that there are only two constants when identifying a user online. First, they’re accessing services through a physical device, like a smartphone, smartwatch, or tablet. Second, they’re located somewhere in the physical world. By combining these two signals, we create a new, highly accurate form of digital identity.

One of the inspirations for this came from a 2013 research paper. The researchers analyzed telecom data and found that with just four location points, they could uniquely identify 95% of the population, even using imprecise data at neighborhood-level granularity. So, we thought: “What if we ran the same experiment using our technology, which can pinpoint location down to the exact apartment?”

When we tried it, our precision reached 99.99999% – an error rate of one in 17 million. That’s 17 times more accurate than Face ID. The only thing more precise than our system is DNA.
In short, Incognia uses device and location intelligence to create the most precise, reliable, privacy-respecting digital identity system available today.

Can you authenticate people in real time, even eliminate the need for logins? Or does it still require something like two-factor authentication?

We do need users to grant location permission. But once that’s in place, we can authenticate them without friction. We’re able to say, “This is who they claim to be,” or alternatively, “This is likely fraud.” And the level of precision is remarkable. Just to give you an idea: in the authentication use case, over the past four years, we haven’t had a single instance where someone could impersonate another user. We’ve authenticated users tens of billions of times, and we’ve never gotten it wrong.

That’s incredible. On that note, what are the top three qualities you think are non-negotiable for success?

The first goes back to ambition. I think that’s inherent to my personality. However, the other two are qualities we’ve intentionally developed as a team at Incognia. One is excellence, which is a really big deal for us. We hold ourselves to a very high standard when it comes to what “good” actually means.

There’s a lot of startup wisdom like “move fast and break things” and “launch as quickly as possible,” but we’re not exactly like that. We ship quickly, but we care deeply about the quality of what we build, given the scale we’re operating at and the responsibility we have in authenticating users for banking systems, helping merchants authorize payments, etc. It’s such a high-stakes game, and we can’t afford to get things wrong. We’re on track to be embedded in over a billion devices globally. If something breaks, we could disrupt critical systems at some of the world’s largest companies.

“We ship quickly, but we care deeply about the quality of what we build… It’s such a high-stakes game, and we can’t afford to get things wrong. We’re on track to be embedded in over a billion devices globally. If something breaks, we could disrupt critical systems at some of the world’s largest companies.”

We’ve also made a conscious decision to be selective about who we work with. We only partner with large enterprises that have a very low risk tolerance for fraud and abuse. That filter helps us stay focused and aligned with customers who view us as mission-critical.

The third quality is trust. We’re in the business of trust. That goes beyond doing the right thing. It’s also about being extremely candid and transparent with both our team and our customers. There have been times when we’ve told a potential customer, “We’re not the right vendor for you,” and even pointed them toward a competitor because the use case wasn’t the right one. We’re highly focused on what we do best.

That level of transparency and selectivity helps us maintain excellence. We’re not trying to be everything to everyone, because if we try that, we’ll end up being great at nothing.

How do you hire for those values? Especially now that Incognia is growing, how do you protect your culture while scaling it?

All the technical screening happens before me. If a candidate has the right skills and is a fit for the position, then I step in to evaluate cultural fit. I do this with every single hire, not just senior leaders. I have interviewed everyone we’ve brought onto the team directly.

The format is also different from the usual. I call it an “interview in reverse.” I don’t ask any questions. Instead, I want them to ask me whatever they want. That’s because the questions they choose to ask say a lot about what they care about. If what matters to them lines up with our values, then that’s a strong sign of a good fit.

But honestly, the most important part of building culture is knowing who you don’t want to work with, It’s tough to figure out before you’ve actually worked with someone, so even if someone has a fantastic resume or a strong track record, we talk about every single hire as a founding team – all six of us. That helps us calibrate what we won’t tolerate.

Letting someone go is also part of it. If we sense it’s not working, we try to make that decision early. It’s not just about protecting the company. It’s about respecting that person’s time.
If they’re a better fit elsewhere, they’ll grow faster there. The saying “hire slow, fire fast” is absolutely true.

Tell me about having six co-founders. How’s that working out?

It works perfectly. We’ve never had any major fights – nothing that ever hurt the relationship. We’ve been working together for 16 years, since our university days. We were all studying computer science, always in the same group, collaborating on every technical project. So, when it came time to build a company, it just felt natural.

Leadership evolved organically. Some are in purely technical roles and aren’t managing people at all, but they’re incredibly strong technically, and that’s where they thrive. There was never a conversation like, “I’m going to be the CEO.” It just happened that way. Everyone naturally gravitated toward their strengths.

That’s the part I’ve been extremely lucky with – finding my co-founders.

I’d like to talk about decision-making. You’ve mentioned that intuition and instinct are important, but only if you have good data backing them up. How do you make that work in practice?

For me, getting information directly from the people on the front lines is more valuable than any dashboard. Of course, we do have dashboards and KPIs, but I’ve found that anecdotes, especially when you hear enough of them, are actually much more insightful.

For example, my Head of Customer Success and Head of Sales Engineering talk to customers weekly. Meanwhile, our data analytics team works directly with customer data to improve our models. These are the people who truly understand what customers need, what they’re asking for, and the level of service they expect. That kind of qualitative insight is more actionable than a dashboard filled with 100 metrics. I’m constantly trying to answer the question: How can we do better for our customers? The people around me have that answer, not a dashboard

How do you maintain product vision during development?

Our strongest area as an organization is technology. This company was founded by six computer science majors. We’re incredibly strict about who we hire and maintain a very high technical bar. And we’re really good at building things.

But the real question isn’t how to build. It’s what to build. And the answer to that comes from our customers. That said, we have a long-term vision: ubiquitous computing, making computers disappear, and redefining identity. Because we’re strong builders, customers recognize that and come to us with all kinds of requests. However, most of what they ask us isn’t aligned with our vision.

For example, we want to make computers disappear. A customer might come to us and say, “Our facial recognition system isn’t working well. Can you build one for us?” It’s a big market and technically interesting. But facial recognition adds friction. It’s not making computers disappear. So even though we could build it, we say no.

Another common request is for us to collect and store more personal data. But part of our vision is privacy. That’s why the company is called Incognia – from “incognito.” Yes, we’re building digital identity, but we don’t want to know who the person is. We don’t want their name, phone number, SSN, or email. Our customers – consumer-facing apps – need personal identifiers. We don’t. That’s why if a customer asks us to store personal data, we know it could improve short-term performance. But we still say no, because it doesn’t align with our long-term privacy vision.

Imagine a data breach that includes not just location signals, but also people’s names, phone numbers, and emails. That would be a disaster. Coming from a security background, I believe every system will eventually get breached, so I won’t risk the future of our company for a short-term gain.

With your deep knowledge of location tech and privacy, what’s your take on the state of digital privacy today?

If you want to build a truly privacy-first system, you can’t compromise on the core principles. Take authentication, for example. We focus on location and device-based identity because those signals can’t be phished. No one’s going to call you and ask, “Hey, what’s your current location?” to steal your identity. But they can call and trick you into giving up a 6-digit two-factor authentication code. That’s why we try to avoid relying on systems that introduce that kind of vulnerability.

Then there’s cryptography. Most people treat it as a checkbox – something you use because it’s standard. But it can do so much more. For example, we use it to verify home addresses. If a device has repeatedly been at a certain location, and the user enters that location as their address, we can confirm the match with high confidence without ever seeing the address in plain text. We do this using a cryptographic method called a trapdoor function. It’s binary: it either confirms or denies the input without revealing or storing any underlying data.

We also use probabilistic data structures, including one we built in-house, to determine whether a data point has been seen before and whether it was tied to good or bad behavior, all without exposing the actual data.

And finally, there’s data minimization. While most companies collect everything “just in case,” we take the opposite approach. Because I believe data breaches are inevitable, we only collect what we need right now. If there’s no immediate use for the data, we don’t collect it.

Do you think AI can eventually help systems reason with less data? And if so, does that help support your privacy-first model?

I do think so. The smarter AI gets, the less data it needs to make the right decision. Of course, it takes a lot of data to get there in the first place, but once it reaches a certain level, it can start reasoning more effectively with less input.

You can already see that trend with large language models. Right now, they still require quite a bit of context to deliver the result you want. But with each new version, they’re getting better at understanding with less. It’s evolving toward requiring less from the user to deliver something useful. From a privacy standpoint, that’s very exciting. It aligns really well with the idea of minimizing data collection without sacrificing performance.

Let’s talk about tech predictions. Any companies, applications, or emerging technologies you’re most excited about?

Humanoid robots are cool, even if I sometimes question why they need to look like us. However, where I see huge potential is in the Internet of Things (IoT). That’s the space I’m really excited about. I just don’t think we’ve seen many truly compelling applications yet.

Once everyday objects start getting smarter and AI develops a better understanding of the physical world, we’ll see an explosion of new applications. Right now, all the most advanced technology is still trapped inside computers and phones. But when that intelligence starts to influence the physical world? That’ll be incredible. Just look at self-driving cars. That’s just one use case, and it’s already transformative. Now, imagine that same level of intelligence applied to everything around us. That’s when computers will disappear.

You’ve made bold moves – moving to the U.S., building a global company, and staying committed to long-term vision over short-term wins. How do you teach others to think bigger?

It comes down to examples. When you see people who came from nothing go on to do transformative things, you start to realize it’s possible. For me, that example was my mom. She came from an extremely humble background. My grandmother had 17 children. Eight passed away. They were very poor and lived in rural Brazil with no access to education.
My mom started working when she was 10 years old. Eventually, she made it to university and studied two majors at once while working. With her income, she brought six of her siblings to the capital and paid for private education for all of them.

Now, she’s a manager at a big company. From where she started to where she landed, it showed me what’s possible. I’ve always thought: “If she could do that, I can do anything.”
I had so many more advantages: a great education and early exposure to English and computer science. So if she could pull that off with what she had, then I can build whatever I set my mind to. She’s the greatest example I could’ve asked for.

---

Beyond the interview:

Here are links to where you can get to know André Ferraz better.

• LinkedIn
• Website