Customer identity and access management (CIAM)

The discipline handles sign-in and access for people outside the organization. Registration, authentication and account security all sit inside it, along with the consent and retention obligations that most jurisdictions attach to consumer data.

Every point of friction added to a customer flow is measured directly in abandoned registrations, which is why CIAM decisions are made jointly with the people who own conversion. A workforce identity team can require an enrollment step. A CIAM team can only make one attractive enough to complete.

On a feature list the two look alike; in production they behave nothing alike. What separates them is leverage. An employee can be instructed to enroll a managed device and finish a training module. A customer can be asked, and that is where the authority ends.

Scale runs in the opposite direction too. Workforce directories hold thousands of records with demanding assurance requirements and a helpdesk standing behind them. Customer directories can hold millions, with a firm limit on what may be asked of each person and no support organization sized to absorb the difference.

Most CIAM evaluations converge on the list below, and the conflict inside it is genuine. Any method that asks a customer for extra effort sets security and usability against one another.

That tension is the argument for deleting the credential instead of layering steps around it. When there is nothing to type, the quick path and the secure path are the same path, which is an exit from the trade rather than a compromise inside it.

• A sign-in that completes in seconds on a phone, on the first attempt.
• Phishing-resistant authentication enabled by default rather than offered as an option.
• Standards coverage: OIDC, OAuth 2.0 hardened by PKCE and PAR, and SAML 2.0 where partners federate.
• A recovery path designed as carefully as the sign-in, because attackers will use it.
• Consent, retention and deletion handling that a privacy team can operate without engineering.
• Tenant isolation and role-based access control for the staff who administer all of it.

Failures cluster in a small number of places, and none of them are the login screen everybody spent the design review discussing.

Recovery is the usual one. A phishing-resistant sign-in in front of an email-based recovery flow inherits the security of the email account, and attackers know which of the two to attack. The others are optional security nobody opts into, and consent records that were never designed to answer the question a regulator eventually asks.

SenseCrypt is a passwordless identity provider for customer identity. A customer is enrolled from a photograph already on file and then signs in with a live face check on their own phone, where liveness and matching both run in the companion app.

Nothing has to be chosen, remembered or reused, and nothing is quoted back during a sign-in, which leaves a phishing page aimed at a customer with no shared password to harvest. IdP retains quantum-safe, sealed, biometric-free, disposable face tokens and their verifier challenges. Standard OIDC/SAML account records, device public keys, sessions, logs and encrypted tenant signing keys also persist. No face images or templates are retained in the documented phone flow. Licensed on-premises Webcam processes captures inside the customer deployment. For a consumer base, that is a materially smaller privacy exposure than a credential database and a face gallery.

Customer identity is licensed per monthly active user rather than per registered account, which matches how consumer directories actually behave, since most accounts are dormant in any given month. Current terms, minimums and trial details are best confirmed directly with us.