Nothing to reset or rotate
Removing passwords removes password resets, expiry policies, quality rules and rotation schedules. Device recovery and other support needs remain.
Employee sign-in
Workforce SSO, passwordless by face.
SenseCrypt IdPLaunchedProvision employees from existing HR photos, enroll their phones and use face-based sign-in over OIDC or SAML. Remove the password path while keeping a defined recovery process.
01Reset costs
Password resets put pressure on your help desk
Workforce identity programs fail on the rollout that never finishes, the resets that never stop, and the shared workstations nobody designed for. The password has a running cost and every organization pays it. Gartner has attributed as much as 20 to 50 percent of help desk volume to password resets, and Forrester has put a single assisted reset at roughly 70 dollars once labor and lost productivity are counted. That is an operating tax on the credential that also happens to be your largest attack surface.
The queue is worse than expensive. It is a documented way in: in 2023 attackers impersonated an employee to the MGM Resorts IT help desk in a single phone call, and the company reported an impact of roughly 100 million dollars. You cannot train your way out of a process whose entire purpose is to help a stranger who says they are locked out.
Recovery requires more than a support call
A recovery call alone cannot satisfy the configured face ceremony. Binding a new phone needs a fresh one-time PIN in the employee’s own mailbox, with an SMS copy when a mobile number is on file, proof of the new device key, and then a face check against the original enrollment reference. Missing access to the verified mailbox or reference requires administrator recovery.
02Rollout
Coverage on day one
Enrollment can delay passwordless rollouts. SenseCrypt can mint face tokens in bulk from existing HR or badge photos without user action or an enrollment fair; employees then bind their phones before using phone-based sign-in.
Staff without a usable photo can self-enroll under an email-domain allow-list and use the same lifecycle, groups and roles as imported users.
The photo is not kept
Each photo is forwarded in memory to a firewalled minting service and dropped the moment the token is minted. It touches no disk, no database and no log, and what remains is a sealed token designed to prevent reconstruction of the face.
First sign-in sets up the phone
The employee installs the companion app and binds it once with a one-time PIN sent to their mailbox. After that the ceremony is a glance, and a PIN is needed again only when binding or replacing a device.
03Frontline work
Built for shared workstations and frontline shifts
Clinics, plants, depots and registers run on machines that belong to nobody. That is precisely where device-bound credentials fall apart, because the credential lives on the wrong device, and the workaround ends up being a shared password taped under the counter.
The workstation displays a code. The worker's enrolled phone performs the cryptographic and face checks, linking the resulting sign-in to that person. Where phones are not allowed, enterprise customers can use the deviceless Simple Webcam method instead; run it on secure terminals, because unsecured terminals expose webcam capture to injection attacks.
No face credential on the station
No face enrollment or installed agent is required on a supported workstation. It can show the sign-in code, while browser sessions and application data remain subject to your workstation policy.
Simpler handovers on shared terminals
The terminal can serve each shift while sessions are ended between users and each sign-in is verified and logged against one individual. Accountability stays personal even when the hardware is not.
One sign-in flow across supported devices
A desk browser, a kiosk and a mobile web page all run the same flow, because none of them need to know anything about the employee in front of them.
04Integration
One enrollment for every internal app
SenseCrypt fronts your applications as an ordinary standards-based identity provider, so the integration is work your team already knows and nothing about your app estate has to change shape. Session persistence is configurable per tenant in the IdP portal: set how long a session lasts, or don't persist sessions at all. With session persistence turned off, each application sign-in is its own ceremony. The admin console keeps its own browser session. Schedule legacy sign-in retirement once the pilot, application validation, device coverage and recovery policy are ready.
SenseCrypt issues roles and permissions in tokens or assertions; your application enforces them. SenseCrypt enforces its own default-closed sign-in group gate and admin-console capability checks.
05Lifecycle
Joiners, movers, leavers
Provision through SCIM 2.0 from your existing directory. Keep the source of truth and lifecycle ownership in one place.
The departure path is the part worth reading twice, because it fails closed rather than fading out.
Provision users before their photo is ready
A user provisioned ahead of their photo is a pending shell that activates at the first ceremony, so onboarding is not blocked waiting for an HR image to arrive.
Verify photo updates against the enrolled person
Replacing the photo mints a new token only when it is biometrically the same person. A swapped image does not quietly become a new way in.
Revoke device keys and refresh tokens
Deprovisioning revokes the person’s device keys and refresh-token families immediately; suspension is enforced at subsequent protected checks and token refresh. Applications must still enforce token expiry and end their own sessions.
06Step-up approval
Approvals that name the action
For sensitive operations such as production changes or payment runs, request a fresh face check through CIBA. FAPI-CIBA is supported for financial-grade flows. Your application must validate the response and enforce the requested action.
The request starts a device-bound live face check. Tapping a prompt or holding the phone alone does not complete that check.
Verify the signed action details
Verify the fields carried in the signed payload. SenseCrypt supports FAPI 2.0 Message Signing for financial-grade flows.
Receive a verifiable authentication result
The calling system receives a pass or a fail it can verify, not a code somebody read aloud on a call.
What the audit records include
Console changes are recorded in a hash-chained, tamper-evident log; end-user sign-ins are recorded in a separate read-only, per-person activity stream that exports to CSV. Your application must log its own access decisions.