Simple QR
Scan an on-screen code and complete the face match on your own device. The enrolled phone acts as the trust anchor via its device key and app attestation. Simple QR is not origin-bound.
SenseCrypt IdP
Passwordless sign-in with a live face check.
Application accessLaunched
SenseCrypt IdP verifies the live person with three login methods on one identity layer, using live face checks for authentication. Session persistence is configurable per tenant in the IdP portal: set how long a session lasts, or don't persist sessions at all. Provision users from existing photos, enroll phones for Simple QR and Passkeys, and let them sign in by face.
Security scope
- Simple QR is not origin-bound. Passkey sign-in combines a WebAuthn assertion with a separate live face proof.
- Simple Webcam processes captures inside the customer deployment, with capture on secure terminals, and does not add an enrolled-phone possession factor.
- SenseCrypt IdP is available as a hosted service or on-premises.
- Replacement-device enrollment requires email verification and a new device key; the enrolled face is still required at sign-in.
- IdP retains quantum-safe, sealed, biometric-free, disposable face tokens and their verifier challenges. Standard OIDC/SAML account records, device public keys, sessions (where the tenant enables session persistence), logs and encrypted tenant signing keys also persist. No face images or templates are retained in the documented phone flow.
- IdP retains encrypted tenant signing keys and uses classical ES256 for OIDC federation. SAML uses separate RSA signing keys. SenseCrypt IdP supports FAPI 2.0, FAPI 2.0 Message Signing and FAPI-CIBA for financial-grade flows. PKI’s post-quantum algorithms and transient private keys are separate from IdP federation.
Transparent pricing: $1/user/month, 20-seat minimum. 30-day full-feature trial, no card required.
Application access
The principalLive
person.Live face check; phone methods add device proof
person.Live face check; phone methods add device proof
The identity layerSenseCrypt
IdP
IdP
OIDCSAML 2.0SCIM 2.0
WorkforceCustomer appsB2B SaaS
01 / Authentication
Three login methods. One identity layer.
A deliberate choice of ceremony for each environment.
Passkeys
Real FIDO2/WebAuthn passkeys with a separate live face proof. This path provides phishing resistance via WebAuthn origin binding; the passkey is held by the companion app on the enrolled phone, acting as a roaming authenticator.
Simple Webcam
An enterprise-only, deviceless option: a webcam captures the biometric, so no phone or secondary device is needed during authorization. Run it on secure terminals: unsecured terminals expose webcam capture to injection attacks, such as virtual-camera or video-stream injection. The licensed on-premises service processes the capture within the customer deployment and does not add an enrolled-phone possession factor. (Contact sales@seventhsense.ai).
Evaluated and tested
The face-recognition algorithm has been evaluated in NIST FRTE since 2021 under Seventh Sense's own name, with liveness covered by iBeta Level 1 and Level 2 presentation-attack testing to ISO/IEC 30107-3 within the tested component and attack conditions.
02 / Enterprise standards
Plugs into your existing stack.
OIDC tokens are signed with classical ES256, separate from the ES256 passkey assertions used at sign-in. Applications use the supported identity protocols and enforce their own access decisions.
- Multi-tenant isolation
- Role-based access control
- SCIM 2.0 directory provisioning
OpenID Connect
OpenID Connect and OAuth 2.0 (RFC 6749), with PKCE (RFC 7636) and pushed authorization requests (RFC 9126). FAPI 2.0 and FAPI 2.0 Message Signing support financial-grade flows.
SAML 2.0
Identity Provider support for legacy federation. Single Logout and HTTP Artifact binding are not implemented.
SCIM 2.0
Automated user provisioning and de-provisioning workflows.
CIBA and FAPI-CIBA
A CIBA request reaches the enrolled person by an emailed sign-in QR and a best-effort push to the enrolled phone; either opens a live face check. Token delivery follows the configured profile.
M2M / Client Credentials
Machine-to-Machine authentication for background services and automated workflows.