SenseCrypt vs Ping Identity

Ping's portfolio now includes biometric authentication, following its acquisition of Keyless. The line that used to run between an enterprise identity platform and a biometric specialist has been crossed from both directions, so a shortlist built on it will never converge.

Three questions still do the work. Where does the match run. What remains on a server once enrollment is finished. And what is a captured artifact worth to an attacker who has it.

SenseCrypt gives the same answer to all three on every deployment, because there is one ceremony and nothing sits behind it as a fallback to answer differently.

A procurement team evaluating biometrics for an enterprise deployment usually asks the storage question last, when it should be first. IdP retains quantum-safe, sealed, biometric-free, disposable face tokens and their verifier challenges. Standard OIDC/SAML account records, device public keys, sessions, logs and encrypted tenant signing keys also persist. No face images or templates are retained in the documented phone flow. Licensed on-premises Webcam processes captures inside the customer deployment.

The retained face token is quantum-safe, sealed, biometric-free and disposable. No face images or templates are retained in the documented phone flow. Tokens are tenant-bound and stored alongside the required account records. ISO/IEC 24745:2022 describes and ISO/IEC 30136:2018 measures.

So the biometric risk register for a SenseCrypt deployment is short. There is no gallery to breach, biometric-free face tokens and account records to assess in a data subject request, and sealed, biometric-free, disposable face tokens and account records to assess on exit. That is what biometric-blind means in practice.

Ping is an enterprise platform with a long record in workforce and customer identity, several deployment models, and the procurement history that large identity programs lean on. Where an identity program spans many systems, several protocols and a long approval cycle, that reach is what is being bought.

SenseCrypt is a service, delivered one way. If your requirement is on-premises or a specific hosting model, Ping covers deployment shapes we do not, and that is a straightforward difference rather than a debating point.

If biometric authentication is what brought you to a Ping conversation, ask where that line lands in the plan you are being quoted and on what timeline, because a capability folded into a large platform is seldom sold the way the standalone company sold it.

Organizations that run Ping seldom have displacing it on the table, and nothing here requires them to. External identity providers register over OIDC or SAML 2.0, which makes SenseCrypt a connection to configure rather than a product to swap in.

Ping keeps the directory, the policy, the application catalog and the audit history. Applications keep pointing at Ping. At sign-in the user is handed onward, the ceremony completes on the enrolled phone, and a standard token or assertion comes back for Ping to turn into the session it has always issued.

Setup is configuration on both sides: metadata or discovery endpoints, a client registration, claim mapping, and the policy that decides who is routed through the new path.

SenseCrypt is a standards-based identity provider that happens to authenticate with a face, rather than a biometric product with protocol support added afterwards. That distinction shows up in integration work: one service issues the token and runs the ceremony, so there is no second system to keep in step.

Two operating boundaries, stated in advance. End-user authentication keeps no operator-side single sign-on session, so each application sign-in is a fresh ceremony and the only browser session in the product belongs to the admin console. The hash-chained tamper-evident log covers console and administrative actions; end-user sign-ins are recorded in a separate read-only activity stream that is not hash-chained and offers no customer-facing chain verification.

Each seat is a dollar a month, with twenty seats as the smallest order. Non-exportable signing keys in a managed key service add twenty dollars per key per month, and the key cannot be copied out by anyone, including us. Tenants and custom domains past the three included in every account are ten dollars per month each. Customer identity deployments meter monthly active users, and the thirty-day trial takes no card.

• OpenID Connect and OAuth 2.0 (RFC 6749), with PKCE (RFC 7636) and pushed authorization requests (RFC 9126)
• SAML 2.0 identity provider, for federation and for direct application integration
• SCIM 2.0 (RFC 7644) provisioning for users and groups
• FAPI-CIBA / CIBA: a backchannel push starts a face check on the enrolled phone.
• Roles and permissions in the token, a default-closed group gate at sign-in, capability checks on console routes
• Tenant isolation, with three tenants or custom domains per account included.