SenseCrypt vs FaceTec

What FaceTec licenses is the face itself. A customer embeds the technology inside an application they own and then supplies everything that surrounds it: the session, the token internal services agree to trust, the directory, the protocol the applications speak. All of that surrounding material is what SenseCrypt sells, with the face serving as the way in.

Capture and token issuance happen inside a single service here, so no seam exists between them for an engineering team to own. Work that would otherwise be written and then maintained simply disappears, and so does a decision that team used to get to make. That trade settles most of these evaluations.

Deepfakes are why the question of what a face component actually covers has become sharper. In February 2024 a finance employee at the engineering firm Arup authorized transfers of about 25 million US dollars after a video call with deepfaked colleagues. That attack targeted a human decision rather than a biometric sensor, but it is the reason buyers now ask exactly which attacks a liveness certificate covers.

Liveness detection in SenseCrypt is tested by iBeta to ISO/IEC 30107-3 Levels 1 and 2. That standard governs presentation attack detection testing: artifacts presented at the sensor, such as a printed photograph, a screen replay, or a mask.

It does not speak to a virtual camera or an injected video stream, and no ISO/IEC 30107-3 result should be read as though it did. Those attacks are addressed by different controls, which is why the two are described separately here rather than merged into one reassuring sentence.

Face recognition, as opposed to liveness, is evaluated in the NIST Face Recognition Technology Evaluation under Seventh Sense's own name, participation since 2021. The report card is public at https://pages.nist.gov/frvt/reportcards/11/seventhsense_000.html, and NIST evaluates algorithms rather than certifying them, which is why we say NIST-evaluated and never anything stronger.

FaceTec's whole business is a single hard problem, solved well and then licensed broadly. The company also opens its liveness technology to a spoof bounty anyone can attempt, a more confident posture than this market usually adopts. None of it overlaps with what we sell.

An organization already running its own directory, its own sessions and its own token service can drop a liveness component into an application and disturb nothing else. Buying an identity provider relocates the sign-in itself, and that is a heavier decision than the procurement line makes it look.

So the shape here is narrower on one axis and considerably wider on another. Take the points below as an account of the shape we picked, not as a deficiency in the one FaceTec picked.

In the table further down, two products with almost nothing in common can earn the same tick for entirely unrelated reasons. Four questions pull them apart faster than any grid will.

Ask us as well as them. Each answer sits under its question here, so whatever gets said on a call can be measured against something written.

SenseCrypt is a standards-based identity provider, so what your application integrates against is an OIDC or SAML endpoint rather than a camera SDK. IdP retains quantum-safe, sealed, biometric-free, disposable face tokens and their verifier challenges. Standard OIDC/SAML account records, device public keys, sessions, logs and encrypted tenant signing keys also persist. No face images or templates are retained in the documented phone flow. Licensed on-premises Webcam processes captures inside the customer deployment.

A seat costs a dollar a month, with twenty as the smallest order. A non-exportable signing key in a managed key service adds twenty dollars per key per month, and the key cannot be copied out by anyone, including us. Tenants and custom domains past the three included in every account are ten dollars per month each, customer identity deployments meter monthly active users, and the thirty-day trial takes no card.

Two limits, named rather than implied: end-user authentication keeps no operator-side single sign-on session, so each application sign-in is a fresh ceremony and the only browser session in the product belongs to the admin console; and the hash-chained tamper-evident log covers administrative actions there, while end-user sign-ins are recorded in a separate read-only activity stream that is not hash-chained.

• OpenID Connect and OAuth 2.0 (RFC 6749), with PKCE (RFC 7636) and pushed authorization requests (RFC 9126)
• SAML 2.0 identity provider, and SCIM 2.0 (RFC 7644) provisioning for users and groups
• FAPI-CIBA / CIBA: a backchannel push starts a face check on the enrolled phone.
• Real FIDO2/WebAuthn passkeys (ES256) through the companion app acting as a FIDO CTAP 2.1 roaming authenticator
• Liveness detection tested by iBeta to ISO/IEC 30107-3 Levels 1 and 2
• Multi-tenant isolation, roles and permissions in the token, a default-closed group gate at sign-in