All of the user information is available in the assertion. You can get at it locally, without having to talk back to us. We just have a web service that makes it easier to verify the cryptographic signatures on that blob. (And it is, of course, open source, so you can run your own if your language of choice doesn't have its own library for local verification.)