01
The decision in brief
Ping now sells biometric authentication too, so the useful comparison is not whether a face is on the menu. Compare where the match runs, what the server keeps after enrollment, and what a captured artifact is worth, then decide whether to add SenseCrypt IdP behind Ping or use it directly.
Choose Ping Identity when
your program spans many systems and protocols, needs specific hosting models, professional services and a long procurement record, or you prefer biometrics inside an existing platform contract.
Choose SenseCrypt IdP when
passwordless face sign-in is the problem itself, and you want matching on the user's phone and no face-image or template database on the server.
Side by side
| Dimension | SenseCrypt IdP | Ping Identity |
|---|---|---|
| What you buy | An identity provider built around a live face check | An enterprise identity platform |
| End-user sign-in | QR or passkey in the SenseCrypt Authenticator app; no password | Several methods, including Keyless biometrics; varies by plan |
| Deployment | Hosted service or on-premises | Several deployment models |
| Working together | Registers in Ping as an external IdP (OIDC or SAML 2.0) | Accepts external identity providers |
| List price | $1 per user per month; 20-seat minimum | Varies by product and plan |
What you buy
- SenseCrypt IdP
- An identity provider built around a live face check
- Ping Identity
- An enterprise identity platform
End-user sign-in
- SenseCrypt IdP
- QR or passkey in the SenseCrypt Authenticator app; no password
- Ping Identity
- Several methods, including Keyless biometrics; varies by plan
Deployment
- SenseCrypt IdP
- Hosted service or on-premises
- Ping Identity
- Several deployment models
Working together
- SenseCrypt IdP
- Registers in Ping as an external IdP (OIDC or SAML 2.0)
- Ping Identity
- Accepts external identity providers
List price
- SenseCrypt IdP
- $1 per user per month; 20-seat minimum
- Ping Identity
- Varies by product and plan
02
Compare more than the face-login feature
Ping Identity acquired Keyless in October 2025, and markets the capability as Zero-Knowledge Biometrics. The line between an enterprise identity platform and a biometric specialist has been crossed from both directions.
Three questions separate the offerings: where verification runs, what each party retains, and what a stolen artifact enables. Ask them of both vendors. SenseCrypt IdP's answers are in the panel below.
On commercial terms, ask which Ping plan includes biometric authentication, and have the module, tier and price confirmed in writing before a business case rests on it.
Verification runs on the enrolled phone
For both phone methods, capture, liveness and comparison happen on the user's own phone. The server keeps no face gallery to match against.
What a captured artifact is worth
The face token is sealed and tenant-bound, and phone sign-in also requires a key bound to the enrolled device. On the passkey method, origin binding means a relayed assertion does not validate against your real domain.
Read a liveness result carefully
ISO/IEC 30107-3 testing covers presentation attacks at the camera, such as a print or a mask. Injection attacks, such as a synthetic stream fed past the camera, are a separate threat and are assessed separately.
03
Running SenseCrypt IdP behind Ping
Organizations that run Ping seldom have displacing it on the table, and nothing here requires them to. Ping accepts external identity providers over OIDC or SAML 2.0, which makes SenseCrypt IdP a connection to configure rather than a product to swap in. There is no pre-built connector; this is standard configuration on both sides.
Ping keeps the directory, the policy, the application catalog and the audit history. Applications keep pointing at Ping. At sign-in the user is handed to SenseCrypt IdP, the face check completes on the enrolled phone, and a standard token or assertion comes back for Ping to turn into the session it has always issued.
Deployment is not a deciding difference in either direction: SenseCrypt IdP is available as a hosted service or on-premises. Ping offers more deployment shapes and a far longer record of running them.
Start with a focused pilot
One application or one group is enough to learn what enrollment costs your support desk. Everything else stays on the current method until you decide otherwise.
Map the claims between providers
SenseCrypt IdP emits roles and permissions in the token. Ping maps them into its own model, and your applications enforce what they always enforced.
Sessions on both sides
Ping still issues the application session. SenseCrypt IdP may keep its own tenant-scoped browser session, configured per tenant in the IdP portal: set how long it lasts to match how often you want a new face check, or don't persist sessions at all.
04
SenseCrypt IdP at a glance
05
Frequently asked questions
Ping already offers biometric authentication. Why look at SenseCrypt IdP?
Because whether a face is on the menu decides little. What decides it is where the comparison runs, what the server holds after enrollment, and what a captured artifact is worth. Ask both vendors. SenseCrypt IdP matches on the user's enrolled phone for both phone methods and keeps no face image or biometric template in that flow; it stores a quantum-safe, sealed face token alongside ordinary account records.
Can SenseCrypt IdP run on-premises?
Yes. SenseCrypt IdP is available as a hosted service or on-premises; ask sales@seventhsense.ai to scope the deployment. Ping still offers more deployment shapes and a far longer record of running them.
How does SenseCrypt IdP attach to an existing Ping deployment?
As an external identity provider over OIDC or SAML 2.0, configured on both sides. Ping keeps the directory, the policy and the application catalog, and issues the session. SenseCrypt IdP runs the authentication: the face check completes on the enrolled phone and a standard token or assertion returns to Ping. See the Ping Identity integration guide.
What does the iBeta result cover, and what does it not?
Presentation-attack detection is tested by iBeta to ISO/IEC 30107-3 Levels 1 and 2, which covers attacks held up at the camera, such as a printed photo, a screen replay or a mask. It does not cover an injected video stream that bypasses the camera. Sign-in runs inside the SenseCrypt Authenticator app on an enrolled phone, with app attestation and device authenticity checks at each ceremony; the webcam method runs on secure terminals. Assess injection separately.
What happens to our data if we leave?
No face images or templates exist to transfer, so users enroll with the next system. Sealed key material can be crypto-shredded, which permanently destroys the ability to open anything it protected.