Support the protocols enterprise customers require
SAML 2.0 with signed assertions, plus OIDC and OAuth 2.0 with PKCE and pushed authorization requests. You fill the section in rather than scheduling the work behind it.
For SaaS builders
B2B SaaS SSO for every tenant.
SenseCrypt IdPLaunchedGive enterprise customers the SSO and directory-led account lifecycle they require. SenseCrypt provides both as a service for your SaaS.
01Enterprise readiness
Enterprise buyers expect SSO
Enterprise buyers do not evaluate single sign-on. They require it. The security questionnaire asks whether you support SAML 2.0 and OIDC, whether provisioning is automatic, and whether their identity team keeps lifecycle control, and a no on any of those can end the conversation before pricing starts.
Building it yourself is not a sprint, it is a permanent commitment: SAML edge cases, metadata handling, key rotation, per-tenant key custody, and an audit story you have to defend to somebody else’s auditor. SenseCrypt IdP has launched as the identity layer your product fronts, so the questionnaire stops being an engineering roadmap: a cryptographically isolated tenant per customer, passwordless face sign-in for their people, and none of it priced as an enterprise upsell.
Plan for customer directory provisioning
At around a thousand seats, manual user management is unacceptable to any IT organization, which is why SCIM 2.0 sits immediately behind SAML in the same questionnaires.
Plan how tenant signing keys are protected
IdP retains encrypted signing keys per tenant, with generation, rotation and custody managed separately from PKI’s transient private keys. OIDC clients verify ES256 signatures using the tenant’s published public keys.
02Pricing
Skip the SSO tax
The industry habit is to lock single sign-on behind the most expensive tier, which the market has come to call the SSO tax: the control buyers need most, priced as a luxury. SenseCrypt’s per-user rate does not move when you turn security on, so offering enterprise sign-in to your customers does not force you to rebuild your own pricing around it.
One dollar per user per month
The list rate is $1/user/month, 20-seat minimum.
Security is not a tier
SAML, SCIM, CIBA, role-based access control and audit logs are in that rate. There is no security edition to upgrade into when a buyer asks for the thing they should always have had.
The trial is the whole product
A 30-day full-feature trial, no card required. You can answer a live security questionnaire before you commit a budget line.
03Multi-tenancy
A tenant per customer, isolated by cryptography
Each business customer has a separate tenant, issuer and encrypted tenant signing keys. OIDC uses classical ES256; SAML uses separate RSA keys and certificates. Applications enforce tenant isolation by validating the signature, issuer, audience and tenant context.
Branding follows the same boundary. Each tenant serves its sign-in surface from up to 25 verified custom domains per tenant, so your customer’s employees authenticate on a page that looks and reads like the product they bought rather than like ours.
04Delegated administration
Let customers manage their own users
Enterprise buyers want lifecycle control in their own hands, and your engineers want it out of theirs. Delegated administration per tenant gives the customer’s IT team its own users, groups and roles without raising a ticket with you, which removes the support path that scales worst as you add logos.
Provisioning runs over SCIM 2.0 with per-tenant tokens, so their directory stays the source of truth and your product follows it.
Their directory creates and removes accounts
Users, groups, filters and bulk operations, driven from the system their IT team already runs. Your product is not the place a leaver gets forgotten.
Deprovisioning at the identity boundary
Deprovisioning revokes the person’s device keys and refresh-token families immediately. Your application must also enforce token expiry and end sessions it already holds.
Record administrative changes
Console changes are recorded in a hash-chained, tamper-evident log; end-user sign-ins are recorded in a separate read-only, per-person activity stream that exports to CSV. That export is what their auditor will actually ask you for.
05End-user sign-in
Passwordless for their whole workforce
The people signing in are your customer’s employees. For the phone methods, they enroll from a photo on file or through self-signup gated to the customer’s email domains, then sign in with their face from their enrolled phone onto whatever device is in front of them.
This is the part that changes the security review rather than merely passing it. You are not offering single sign-on with the same phishable secret still sitting behind it. There is no password to stuff and no code to read out, and on the passkey path the FIDO2/WebAuthn signature is bound to your origin, which is what lets that path resist phishing.
The match runs on the employee’s device
For the phone methods, capture and face verification happen on the enrolled phone. IdP retains quantum-safe, sealed, biometric-free, disposable face tokens and their verifier challenges. Standard OIDC/SAML account records, device public keys, sessions (where the tenant enables session persistence), logs and encrypted tenant signing keys also persist. No face images or templates are retained in the documented phone flow. Face tokenization and Face PKI are patent-pending.
iBeta-tested liveness. NIST-evaluated underlying ML face verification technology.
Liveness has iBeta Level 1 and Level 2 presentation-attack testing to ISO/IEC 30107-3, covering the tested component and camera attack conditions. Our face recognition has been evaluated in NIST FRTE under Seventh Sense's own name since 2021. That is evaluation, not certification.
A PIN appears at device binding
Binding a phone, first or replacement, uses a one-time PIN sent to the mailbox, with an SMS copy when a mobile number is on file. Sign-in itself never asks for a code. Simple QR is not origin-bound; phishing resistance is specific to the passkey path.
06Billing
How usage-based billing works
Billing follows the shape of your business rather than a tier sheet: metering depends on whether the deployment serves workforce or customer identities.
Model user charges, managed signing keys, and additional tenants and custom domains before committing to a tenant-per-logo design. Size tenants and domains against your expected customer count. A signing key held in a managed key service is $20/key/month. Three tenants and three custom domains are included; each additional tenant or custom domain is $10/month.
Seats bill at the high-water mark
Workforce seats are charged on the period’s peak, so adding staff mid-month does not turn into a reconciliation exercise at renewal.
External users bill in arrears
Customer identities are counted as monthly actives after the fact. The ones that never signed in are not on the invoice.