Government and national eID
eIDAS 2.0 · DPDPAPainIssuer custody of biometric templates is a permanent breach surface.
SolveOffline-verifiable, revocable eID with no stored biometric — verify at a kiosk with a prepared supported verifier.
SenseCrypt KYA — Know Your Agent
Give AI agents authority tied to a verified human.
Agent authorizationEarly access
KYA gives each agent a verifiable credential authorized by a biometrically verified human. Record who authorized the agent, its scope and expiry. Connected applications enforce those permissions.
Security scope
- The credential records human authorization, scope and expiry. The consuming application must enforce its permissions.
- Recognition and liveness component evaluations do not certify the entire agent authorization system.
Console
$ scope: trade.execute - max $10,000 - ttl 1hStatusAwaitingAgent proposes an action requiring elevated privileges.
Trace agent authority to
a verified person.
Human VC
A biometric verifiable credential via SenseCrypt ZKP establishes the accountable human principal.
Agent VC
The human acts as CA and signs the Agent VC — embedding model hash, scope, and expiry.
Agent key
A per-action key-pair from KDF(agent_cred, purpose), with a transient private key. This agent-credential flow is distinct from PKI’s live-biometric face sign and face decapsulate operations.
Per-action signature
Connected tool calls signed — reducing reliance on API keys, OAuth, and bearer tokens where the integration supports this flow.
Five questions · every action
Five questions. A signed record of authority.
- Who
- Traced to a verified human via an unbroken cryptographic chain.
- What
- Model hash and scope constraints embedded in the agent certificate.
- When
- Time-bound credentials that auto-expire — minutes, not months.
- Why
- Signed intent capturing the instruction that initiated the action.
- How
- An authenticated tunnel — no public exposure of internal tools.
Issued once. Unlocked by a face.
Signed every time.
The credential
A credential is bound to a human and post-quantum signed at issuance. ~1500 bytes, no biometric images or plaintext template, unlinkable by default, revocable, and offline-verifiable with a prepared supported verifier.
SenseCrypt eIDThe live face check
A live face unlocks the credential — passing three integrity gates. Silent failure on any miss; the on-device flow returns no recovered secret on failure.
Liveness · on-deviceTwo operational branches
SenseCrypt ZKP supports zero-knowledge presentation and selective disclosure. SenseCrypt PKI generates post-quantum key-pairs from a live biometric, stores public keys, and never stores the private keys used during face sign or face decapsulate. Public keys, signatures and decapsulated shared secrets go directly to relying party endpoints, without the IdP seeing them.
Prove · or · sign
Defense in depthSilent failure on any miss
- CRC check — entropy recovery
After polar-code soft decoding, a CRC confirms the live face was close enough to the enrolled biometric. Wrong face → silent fail.
- AES-GCM auth tag — CSV decryption
The authenticated tag verifies the recovery data and ciphertext were not tampered with. Tamper → silent fail.
- Issuer signature — reconstructed root
The on-device Merkle root is verified against the issuer signature (ML-DSA-87). Forged credential → silent fail.
Key continuityDesigned to recover the key
Designed to recover the key
as your face changes.
The construction is designed to recover the same seed as appearance changes, within its evaluated operating range.
- YR 1
- YR 3
- YR 7
- YR 10
Six use cases.
One human foundation.
Explore how the face-derived credential applies to six buyer groups, each with its own integration and deployment requirements.
Financial services
FATF · MiFID IIPainPhishable SCA, MFA fatigue, and every bank rebuilding and storing KYC.
SolveFace-derived transaction signatures and reusable eKYC — the bank verifies signatures, never the face.
Enterprise zero-trust
NIST Zero TrustPainPassword-reset cost, shared terminals, and unmanaged BYOD endpoints.
SolvePerson-bound passwordless that survives lost phones, shared and unmanaged devices.
Healthcare
DEA EPCSPainShared terminals, clinician switching, and phishable hard tokens for prescribing.
SolveFast auth with no local templates; the prescription itself a face-gated credential.
AI platforms
EU AI Act · Art 50PainAgents act under borrowed credentials. No accountability, no provenance.
SolveHuman-authorized agent certificates with scope, expiry, and signed intent.
Wallets and web3
Privacy-focused PoPPainSeed-phrase recovery, sybil bots, and banned centralized iris custody.
SolveLive-face unlock of portable credentials; proof-of-personhood subject to the applicable regulatory requirements, zero biometric database.
Deploys above existing infra
- IAM / CIAM
- OIDC · SAML · FIDO
- X.509 · mTLS
- Verifiable credentials
- MCP · Agent certs
Choose your SenseCrypt product.
The SenseCrypt stack spans an available consumer app and core developer SDK, a launched enterprise identity provider, and products offered through early access or design partnerships.
Lume Auth
Personal app · iOS + AndroidFour security apps in one, unlocked by your face — no master password, ever. MFA authenticator, post-quantum encrypted chat, password manager, and secure notes. Zero-knowledge by construction.
SenseCrypt IdP
Application access · LaunchedA multi-tenant OIDC issuer and SAML 2.0 IdP with SCIM provisioning. End users sign in with their face — verified on their own phone — instead of a password. Drops in above your existing IAM.
SenseCrypt SDK
Developers · Wallet + verifierOne wallet SDK and one verifier SDK. The verifier ships the STARK circuit and X.509 libraries; the wallet handles enrollment, recovery, and proof generation. Mobile, server, edge, and air-gapped.
Research and evidence
open to review.
Review the named standards, threat model and public research roadmap. Assess the engineering through the evidence and milestones we publish.
- 9+Patents pending
Core filing covering eID, SenseCrypt ZKP, SenseCrypt PKI, KYA, and refresh.
- Top 10NIST FRVT
The underlying face engine, independently ranked globally in the Q1 2022 NIST FRVT result.
- ≥256Bits · PQC cat-5
Residual entropy at realistic face error rates — by design.
- 4Disciplines fused
ML · PQC · zero-knowledge · polar codes — no competitor combines all four.
Standards & validation
- NIST NCCoE
- AI agent-identity feedback + collaborator candidate
- IETF LAMPS
- One of two global PQC reference verifiers
- OpenCV
- Powers the face-recognition pipeline
- iBeta · NIST FRVT
- L1+L2 anti-spoofing · Top-10 accuracy (Q1 2022)
Falsifiable by design
The research roadmap sets out claims and milestones for external scrutiny.
Leadership — serial foundersPrior security exit to Intel / McAfee
- Varun ChatterjiCo-Founder · Technology
Cryptography & ML architect. Co-founded tenCube (mobile security), acquired by McAfee / Intel.
- Ashish KushwahaCo-Founder · Business
10+ years in semiconductors. Co-founder of a publicly-listed venture. MBA, Cornell.