01
The decision in brief
When two vendors both describe themselves as privacy-preserving, compare where each design performs verification, what each party retains, and which compromises its security model assumes. Then weigh the procurement facts: Keyless is bought from Ping, SenseCrypt IdP from Seventh Sense.
Choose Keyless when
you already hold a Ping relationship and adding biometrics inside an existing platform contract is the faster purchase.
Choose SenseCrypt IdP when
you want the face check and the identity provider in one product, with matching on the user's phone and no face-image or template database.
Side by side
| Dimension | SenseCrypt IdP | Keyless |
|---|---|---|
| What you buy | An identity provider built around a live face check | Biometric authentication, sold inside Ping Identity's platform |
| Federation | OIDC, SAML 2.0, SCIM 2.0, CIBA | Through Ping's platform |
| Purchased from | Seventh Sense | Ping Identity |
| List price | $1 per user per month; 20-seat minimum | Varies by plan |
What you buy
- SenseCrypt IdP
- An identity provider built around a live face check
- Keyless
- Biometric authentication, sold inside Ping Identity's platform
Federation
- SenseCrypt IdP
- OIDC, SAML 2.0, SCIM 2.0, CIBA
- Keyless
- Through Ping's platform
Purchased from
- SenseCrypt IdP
- Seventh Sense
- Keyless
- Ping Identity
List price
- SenseCrypt IdP
- $1 per user per month; 20-seat minimum
- Keyless
- Varies by plan
02
Compare two approaches to biometric privacy
Keyless, now part of Ping Identity, has described an approach built on secure multi-party computation. SenseCrypt IdP takes a different route to a related goal: a sealed face token that cannot be reversed into a face, with the comparison itself performed on the user's enrolled phone.
Read each approach in its own vendor's words: Ping Identity's announcement for Keyless, and this page for SenseCrypt IdP. Marketing adjectives converge in this category; the architecture does not.
The other difference is scope. Keyless is a biometric authentication technology, now sold inside Ping Identity's platform. SenseCrypt IdP is the identity provider around the face check, issuing the tokens your applications already consume.
Face verification runs on the phone
For both phone methods, capture, liveness and matching run on the user's own phone. The licensed enterprise webcam method is the exception: captures are processed inside the customer's deployment, on secure terminals.
Sign-in and federation in one product
A single service runs the face check and serves OIDC and OAuth 2.0, SAML 2.0, SCIM 2.0 and CIBA, so nothing has to be kept at a matching version with anything else.
03
What to check after an acquisition
Ping Identity completed its acquisition of Keyless in October 2025. If your evaluation of Keyless started before then, part of it needs redoing. We will not guess at another company's roadmap or packaging, and you should be wary of any vendor page that does.
Send one identical set of questions to each company and read the written replies together. Our answers are below.
Which plan includes biometric authentication?
Ask Ping for the module, the tier and the term before a business case rests on them.
Where does face verification run?
SenseCrypt IdP matches on the enrolled phone for both phone methods, and states the exception: the licensed webcam method processes captures inside the customer's deployment, on secure terminals.
What persists after enrollment?
Ours: quantum-safe, sealed, biometric-free, disposable face tokens and their verifier challenges, plus ordinary identity-provider records. No face images or templates are retained in the documented phone flow.
Who supports production incidents?
After an acquisition, support paths and escalation routes can change. Ask who you call at three in the morning, and get the answer before signing.
04
SenseCrypt IdP at a glance
05
Frequently asked questions
Keyless is part of Ping now. Does that change the comparison?
It changes the purchase more than the technology. You are evaluating a biometric capability inside a large identity platform rather than an independent supplier, so ask Ping which plan carries it, how it is packaged, and who owns support and escalation. Get those answers in writing before a business case depends on them.
Both vendors describe themselves as privacy-preserving. How do we tell them apart?
Ask each vendor where verification runs, what persists after enrollment, and which compromises its security model assumes. SenseCrypt IdP's inventory is a sealed face token and its verifier challenge, plus ordinary identity-provider records; the full list is on What each product retains. Compare that with the other vendor's own description.
Does SenseCrypt IdP need the user's phone every time?
For the QR and passkey methods, yes: the SenseCrypt Authenticator app on an enrolled phone is required whenever a fresh face ceremony is needed; session reuse depends on the tenant's persistence setting in the IdP portal. The device being signed in to, whether a browser, kiosk or desktop, needs no enrollment. Simple Webcam, a deviceless mode for enterprise customers, uses a webcam to capture the biometric and no phone, on secure terminals.