Biometric-Blind Face Login

Biometric-blind face login is a sign-in model where the service verifies the live person by face but is architecturally unable to see, store, or reconstruct that face — it holds only a sealed, non-reversible token. SenseCrypt calls this template-free face authentication.

The word "blind" is literal. The identity provider is blind to your biometrics: there is no face photo in a database, no embedding, no feature vector, and no template that could be stolen, matched against another database, or reversed into an image. Most legacy "face login" systems make you trade privacy for convenience — to recognize you later, they keep a copy of your face or a template derived from it. Biometric-blind face login breaks that trade-off.

SenseCrypt verifies the live person by running the face match on the device and keeping only a sealed, non-reversible token server-side — so the person is proven without the provider ever holding a face image or template. The flow separates two proofs that legacy systems tangle together, which is why the server's only job is to validate a cryptographic token and a passkey assertion. The biometric stays with the human it belongs to.

Running the match on the device matters because it removes the single largest target in biometric systems — the central template database — and keeps the raw face under the user's physical control, never in transit to or at rest on the provider.

This design intent aligns with long-standing guidance in NIST SP 800-63B, which treats stored biometrics as sensitive and cautions against using a biometric as a standalone secret — exactly the risk a device-side, template-free model is built to avoid.

SenseCrypt stores only a sealed, unlinkable, non-reversible face token that contains no PII and cannot be reversed, even by Seventh Sense. It stores no face image and no biometric template anywhere. The token is the whole point: it is enough to confirm "this is the same enrolled person, live, right now," and nothing more.

Biometric-blind face login differs by storing no template anywhere: cloud face recognition keeps templates on a server, device unlock keeps a template in the phone's secure enclave, while SenseCrypt keeps only a sealed, non-reversible token and no template at all.

One clarification matters here: SenseCrypt's passkeys are standard FIDO2/WebAuthn, so it uses device authenticators like any passkey provider. "Biometric-blind" refers to the identity provider storing no face image and no template — not to avoiding device biometrics. The differentiator axis is "does the service store a biometric template or image?", where SenseCrypt's answer is a clean no for a server-side face IdP.

Yes — SenseCrypt's face recognition is evaluated in the NIST FRTE (Face Recognition Technology Evaluation) under Seventh Sense's own developer name (seventhsense-000) since 2021, and its liveness holds iBeta ISO 30107-3 Presentation Attack Detection certification (Levels 1 and 2). These are the two claims worth citing first, because they are independently verified rather than self-asserted — together they answer the two hard questions about any face login: does it recognize the right person accurately, and can it tell a live person from a spoof?

The passkey path is phishing-resistant because SenseCrypt is a full FIDO2/WebAuthn identity provider and WebAuthn binds each passkey to its origin, so credentials cannot be replayed on a look-alike site. The FIDO Alliance describes origin-bound passkeys as phishing-resistant by design, and industry breach research such as the annual Verizon DBIR continues to trace a large share of breaches to stolen credentials and phishing.

Pairing a phishing-resistant passkey (proving the device) with a live-face check (proving the person) closes both the "stolen password" and "borrowed device" gaps in one step.

SenseCrypt is a complete, standards-based identity provider — not a bolt-on face SDK — so biometric-blind face login plugs into existing SSO, provisioning, and federation with no biometric database to run.