How verification works

A verified-resident badge tells your neighbors a post comes from someone who actually lives under this HOA, not a board member or someone passing through. Earning it means proving your address once. The point of this page is the other half: showing you, in plain terms, that we read that proof and then throw it away. We call it validate, then forget.

What you photograph

Something that shows your address at this community. The easiest is a piece of postmarked mail addressed to you, still in its envelope. A residency document works too: a recent utility bill, a letter from the HOA or its board, a lease, or a government or tax notice. A clear live photo is enough. You pick the community you live in first, so the check knows what it is confirming against.

If you verify inside the app, two optional signals help confirm the check is genuine: with your permission the app reads your device’s location once at capture to confirm you are near the community, and it checks that the app is running on a real device. Both are used only in the moment, and neither is stored.

What happens the moment you submit

  1. Step 1:The file is held in memory on the server for the length of one request. It is never written to a database column or a storage bucket, and no person ever opens it.
  2. Step 2:An AI vision read pulls the address off the mail or document and judges, conservatively, whether it falls within the community you claimed — a yes or no and a confidence score from 0 to 1. We also send just the address to a mapping service (Google) to confirm, independently, the city and state it lands in, so a plain utility bill or envelope that never prints your HOA’s name still counts. Both checks run in memory.
  3. Step 3:If the read is genuine proof, an address is found, it lands in your community, and confidence clears 0.75, the badge is granted. Anything short of all four fails closed: no badge is ever handed out by default.

When the request finishes, the document and the address you uploaded fall out of memory for good. There is no code path that could save them, because we never wrote one.

Exactly what we keep, and what we throw away

When a check finishes, five short facts are written to the database. Everything else is already gone.

What we keep

  • That you are verified (or were rejected).
  • Which community it was for.
  • When the check ran.
  • The confidence score behind the decision.
  • A one-way hash of the address, described below.

What we throw away

  • The document itself. It is never stored.
  • The raw address, in readable form.
  • Whatever the mapping service returns for the address — we keep the city/state answer only long enough to score the check.
  • Your name and anything else printed on the file.
  • In production, the address never lands in our logs either.

The one thing we keep about your address

We do not keep your address. We keep a one-way hash of it: the address is normalized and run through a salted HMAC-SHA256 function, which turns it into a fixed string of characters that cannot be turned back into the address. The same address always produces the same hash, and nothing else does.

That one property is all we need to stop one address from quietly verifying a swarm of accounts and stuffing an HOA's ratings. An address can verify at most 2 accounts, so a genuine two-resident household still works; the third attempt on the same address fails closed. The guard runs by comparing hashes, never by reading an address, because we do not have one to read.

Where the badge lives

The badge attaches to the pseudonymous identity you post under, and shows only in the community you verified. It is not linked to your login email, and it carries no trace of the address or document behind it. Neighbors see that you are verified. They never see how, and neither do we after the fact.

A best-effort check, not a guarantee

Verification is an automated read, and we hold it to a high bar: it fails closed, so an unclear photo or a low-confidence read earns no badge. But no automated check is perfect. A determined faker might still get through, and a genuine resident with a poor photo might be turned away and need to try again. Treat the badge as a strong signal that a post comes from a real resident, not as a promise we can guarantee. If you see a badge that looks wrong, report it and we will look into it.

For the full picture of what Fenceline collects and why, see our Privacy Policy.