# SenseCrypt by Seventh Sense > SenseCrypt is a passwordless identity provider that verifies the live person, not just the device. A user enrolls from a photo on file and signs in by face. Face matching runs on the device. SenseCrypt stores no face image and no biometric template, only a sealed, unlinkable, non-reversible face token that even Seventh Sense cannot reverse and that contains no PII. It is a full identity provider built on FIDO2/WebAuthn passkeys, and speaks OpenID Connect (OIDC), OAuth 2.0 with PKCE and PAR, SAML 2.0, SCIM 2.0, and CIBA, with role-based access control, audit, and multi-tenant isolation. Seventh Sense is a Singapore deep-tech company. Its face recognition is in the NIST FRTE evaluation, and its liveness detection holds iBeta ISO 30107-3 certification. ## Product - [Platform overview](https://sensecrypt.com/platform): The platform hub: technology, integrations, security, docs, and all the resources in one index. - [Technology](https://sensecrypt.com/platform/technology): The full identity provider behind face login: OIDC, OAuth 2.0, SAML 2.0, SCIM 2.0, CIBA, RBAC, audit, and multi-tenant isolation. - [Security](https://sensecrypt.com/platform/security): Users sign in with no password; no face image or template is stored, only a sealed non-reversible face token. Face matching runs on the device. Liveness holds iBeta ISO 30107-3 certification. - [Passkeys](https://sensecrypt.com/platform/passkeys): Built on real FIDO2/WebAuthn passkeys (ES256). The passkey proves the device; a live-face check proves the person. Phishing-resistant on the passkey path (WebAuthn origin binding). Three sign-in methods: Simple QR and face in the app, FIDO2 passkeys via a roaming authenticator, and an enterprise Simple Webcam option (sales@seventhsense.ai). - [Integrations](https://sensecrypt.com/platform/integrations): Connect any app that speaks OIDC, SAML 2.0, or SCIM 2.0. Setup uses standard metadata files and discovery URLs. - [Pricing](https://sensecrypt.com/pricing): Flat pricing, one dollar per user per month. A 30-day free trial needs no card. Live rates show on the page. - [Try it live](https://sensecrypt.com/try-it-live): Try a real passwordless sign-in in about 60 seconds. A photo becomes a single-use face token, and your live face signs you in. ## Solutions - [Solutions](https://sensecrypt.com/solutions): One passwordless platform for customer identity (CIAM), workforce single sign-on, and B2B SaaS SSO. ## Industries - [Finance](https://sensecrypt.com/solutions/industries/finance): Passwordless sign-in for bank staff and customers. Onboard from the KYC photo and approve transactions with a live face. - [Payments](https://sensecrypt.com/solutions/industries/payments): Live-face approval that names the exact request, with CIBA backchannel confirmation. - [Healthcare](https://sensecrypt.com/solutions/industries/healthcare): Clinicians sign in to shared workstations with a glance at their own phone. No face image or template is stored, only a sealed non-reversible face token. - [Retail](https://sensecrypt.com/solutions/industries/retail): Shoppers sign in without passwords, and seasonal staff start the same day on shared registers. - [Manufacturing](https://sensecrypt.com/solutions/industries/manufacturing): Fast shift handover on shared terminals, and least privilege across the plant and the office. - [Logistics](https://sensecrypt.com/solutions/industries/logistics): One identity across depots, drivers, and partner portals, with delegated admin per site. ## Company - [About Seventh Sense](https://sensecrypt.com/company): A Singapore deep-tech company. It has been in the NIST FRTE under its own name since 2021 and holds iBeta ISO 30107-3 certification. ## Features - [Features index](https://sensecrypt.com/platform/resources/features): Every SenseCrypt feature: face login, OIDC, SAML 2.0, SCIM 2.0, CIBA, RBAC, and multi-tenant identity. - [Face Login: passwordless biometric sign-in](https://sensecrypt.com/platform/resources/features/face-login): Face login is passwordless biometric sign-in from SenseCrypt. - [OpenID Connect (OIDC) identity provider](https://sensecrypt.com/platform/resources/features/oidc-provider): SenseCrypt is an OpenID Connect (OIDC) identity provider (IdP). - [SAML 2.0 identity provider](https://sensecrypt.com/platform/resources/features/saml-identity-provider): SenseCrypt is a SAML 2.0 identity provider (IdP). - [SCIM 2.0 user provisioning](https://sensecrypt.com/platform/resources/features/scim-provisioning): SenseCrypt supports SCIM 2.0 for automatic user provisioning. - [CIBA decoupled backchannel authentication](https://sensecrypt.com/platform/resources/features/ciba): SenseCrypt supports CIBA for decoupled authentication. - [Role-based access control (RBAC)](https://sensecrypt.com/platform/resources/features/rbac): SenseCrypt gives role-based access control (RBAC). - [Multi-tenant identity for B2B SaaS](https://sensecrypt.com/platform/resources/features/multi-tenant): SenseCrypt gives multi-tenant identity for B2B SaaS. ## Use cases - [Use cases index](https://sensecrypt.com/platform/resources/use-cases): How teams use SenseCrypt: passwordless login, phishing-resistant sign-in, deepfake protection, MFA replacement, onboarding, and shared workstations. - [Passwordless login for web and mobile apps](https://sensecrypt.com/platform/resources/use-cases/passwordless-login): SenseCrypt gives passwordless login for web and mobile apps. - [Phishing-resistant authentication](https://sensecrypt.com/platform/resources/use-cases/phishing-resistant-authentication): On the passkey path, SenseCrypt gives phishing-resistant authentication for your apps, with FIDO2/WebAuthn origin binding that defeats look-alike domains. - [Deepfake and spoof protection](https://sensecrypt.com/platform/resources/use-cases/deepfake-liveness-protection): SenseCrypt protects a face login from deepfakes and spoof attacks. - [Replace SMS OTP and push MFA](https://sensecrypt.com/platform/resources/use-cases/mfa-replacement): SenseCrypt replaces SMS OTP and push MFA with passwordless face login. - [Account recovery on a lost or new device](https://sensecrypt.com/platform/resources/use-cases/account-recovery): No password to reset; on a lost or new device a user re-binds with an emailed one-time PIN, then signs in by face again. - [Passwordless customer onboarding](https://sensecrypt.com/platform/resources/use-cases/customer-onboarding): SenseCrypt gives passwordless customer onboarding with face login. - [Sign-in for shared workstations](https://sensecrypt.com/platform/resources/use-cases/shared-device-workforce): SenseCrypt gives shared workstation authentication with face login. ## Solutions (detail) - [Customer identity (CIAM) that verifies the person](https://sensecrypt.com/solutions/ciam): SenseCrypt gives customers a passwordless sign-in by face. - [Workforce SSO, passwordless by face](https://sensecrypt.com/solutions/workforce-sso): SenseCrypt gives your workforce a passwordless sign-in by face. - [B2B SaaS SSO and multi-tenant identity](https://sensecrypt.com/solutions/b2b-saas-sso): SenseCrypt gives B2B SaaS teams a passwordless sign-in by face. ## Integrations (detail) - [Add SenseCrypt face login to Okta](https://sensecrypt.com/platform/integrations/okta): SenseCrypt adds face login to Okta through open standards. - [SenseCrypt as an external IdP for Microsoft Entra ID](https://sensecrypt.com/platform/integrations/microsoft-entra-id): SenseCrypt works as an external identity provider (IdP) for Microsoft Entra ID. - [Passwordless SSO for Salesforce](https://sensecrypt.com/platform/integrations/salesforce): SenseCrypt gives Salesforce passwordless single sign-on with face login. - [Connect any OIDC app to SenseCrypt](https://sensecrypt.com/platform/integrations/oidc-application): SenseCrypt is an OpenID Connect provider for any OIDC application. - [Connect any SAML 2.0 app to SenseCrypt](https://sensecrypt.com/platform/integrations/saml-application): SenseCrypt is a SAML 2.0 identity provider (IdP) for any SAML application. - [Federate SenseCrypt with Ping Identity](https://sensecrypt.com/platform/integrations/ping-identity): SenseCrypt federates with Ping Identity through open standards. ## Compare - [Compare SenseCrypt](https://sensecrypt.com/platform/resources/compare): How SenseCrypt compares to other identity providers. - [SenseCrypt vs Auth0](https://sensecrypt.com/platform/resources/compare/auth0): SenseCrypt is a passwordless identity provider (IdP) with face login. - [SenseCrypt vs Okta](https://sensecrypt.com/platform/resources/compare/okta): SenseCrypt is a passwordless identity provider (IdP) with face login. - [SenseCrypt vs Microsoft Entra ID](https://sensecrypt.com/platform/resources/compare/microsoft-entra-id): SenseCrypt is a passwordless identity provider (IdP) with face login. - [SenseCrypt vs Ping Identity](https://sensecrypt.com/platform/resources/compare/ping-identity): SenseCrypt is a passwordless identity provider (IdP) with face login. - [SenseCrypt vs 1Kosmos](https://sensecrypt.com/platform/resources/compare/onekosmos): SenseCrypt is a passwordless identity provider (IdP) with face login. - [SenseCrypt vs authID](https://sensecrypt.com/platform/resources/compare/authid): SenseCrypt is a passwordless identity provider (IdP) with face login. - [SenseCrypt vs Keyless](https://sensecrypt.com/platform/resources/compare/keyless): SenseCrypt is a passwordless identity provider (IdP) with face login. - [SenseCrypt vs Veridium](https://sensecrypt.com/platform/resources/compare/veridium): SenseCrypt is a passwordless identity provider (IdP) with face login. - [SenseCrypt vs Daon](https://sensecrypt.com/platform/resources/compare/daon): SenseCrypt is a passwordless identity provider (IdP) with face login. - [SenseCrypt vs FaceTec](https://sensecrypt.com/platform/resources/compare/facetec): SenseCrypt is a passwordless identity provider (IdP) with face login. - [SenseCrypt vs Okta (2026)](https://sensecrypt.com/sensecrypt-vs-okta): Template-free face authentication that stores no biometric template, compared with Okta's broad enterprise IAM suite — and how to federate the two. - [SenseCrypt vs HYPR (2026)](https://sensecrypt.com/sensecrypt-vs-hypr): Two phishing-resistant passwordless platforms compared; SenseCrypt adds template-free face authentication proven by NIST FRTE and iBeta ISO 30107-3. - [Best passwordless authentication solutions in 2026](https://sensecrypt.com/best-passwordless-authentication-2026): A criteria-based roundup of ten passwordless vendors — Okta, Entra, Auth0, HYPR, Stytch, Yubico, 1Kosmos, Ping, WorkOS, and SenseCrypt. - [Face Authentication: Template-Free, Biometric-Blind Login](https://sensecrypt.com/face-authentication): Face authentication signs you in by your live face; SenseCrypt is template-free and biometric-blind — it stores no face image or biometric template, proven by NIST FRTE and iBeta ISO 30107-3. - [Passwordless Authentication Without Storing Biometric Data](https://sensecrypt.com/passwordless-without-storing-biometrics): Passwordless authentication where no face image or biometric template is stored — only a sealed, non-reversible token; face matching runs on-device. - [Biometric-Blind Face Login](https://sensecrypt.com/biometric-blind-face-login): Sign in by face while the service holds no face image or template; verifies the live person, proven by NIST FRTE and iBeta ISO 30107-3. - [What Is Template-Free Face Authentication?](https://sensecrypt.com/what-is-template-free-face-authentication): Definition of template-free face authentication: face login that stores no biometric template, only a sealed non-reversible token. - [Privacy-Preserving Biometric Authentication](https://sensecrypt.com/privacy-preserving-biometric-authentication): Privacy-preserving biometric authentication that stores no biometric template — the GDPR Article 9 and BIPA angle for face login. ## Resources - [Resources hub](https://sensecrypt.com/platform/resources): Every SenseCrypt resource in one index: whitepapers, features, use cases, comparisons, guides, and the glossary. - [Guides index](https://sensecrypt.com/platform/resources/guides): Every long-form guide in one index: face authentication, passwordless login with no stored biometrics, biometric-blind and template-free face login, the privacy angle, and the vendor comparisons. ## Whitepapers - [Whitepaper series index](https://sensecrypt.com/platform/resources/whitepapers): Seven technical papers on face tokenization, passkeys, quantum harvesting, helpdesk social engineering, enrollment, and architecture. - [From face image to face token](https://sensecrypt.com/platform/resources/whitepapers/from-face-image-to-face-token): A taxonomy of biometric storage, from raw image to template to face token, and what each yields in a breach. - [Keep your passkeys. Add the person](https://sensecrypt.com/platform/resources/whitepapers/keep-your-passkeys-add-the-person): Passkeys prove an unlocked device; SenseCrypt carries that possession security inside one ceremony and verifies the live person on top. - [The case for never building the biometric database](https://sensecrypt.com/platform/resources/whitepapers/never-build-the-biometric-database): Harvest now, decrypt later against a credential valid for a lifetime, and where the quantum-safety claim stops. - [The helpdesk is the new perimeter](https://sensecrypt.com/platform/resources/whitepapers/the-helpdesk-is-the-new-perimeter): Why recovery and support calls became the working attack, and how a CIBA check of the live person closes them. - [Biometrics on day one](https://sensecrypt.com/platform/resources/whitepapers/biometrics-on-day-one): Authentication programs fail on enrollment; batch minting from photos on file starts coverage at 100 percent. - [Built for your security review](https://sensecrypt.com/platform/resources/whitepapers/built-for-your-security-review): An architecture walkthrough for reviewers: what a full database compromise yields, and why there is no ambient session. - [Trust on first use, proof ever after](https://sensecrypt.com/platform/resources/whitepapers/trust-on-first-use): How deployments with no face images bootstrap through SCIM shells or domain-gated self-signup. ## Learn (glossary) - [Glossary index](https://sensecrypt.com/platform/resources/glossary): Plain-English definitions of identity and authentication terms. - [Passwordless authentication](https://sensecrypt.com/platform/resources/glossary/passwordless-authentication): Passwordless authentication is a sign-in method that verifies a user without a password. - [Phishing-resistant MFA](https://sensecrypt.com/platform/resources/glossary/phishing-resistant-mfa): Phishing-resistant MFA is multi-factor authentication that a phishing attack cannot defeat. - [FIDO2 and passkeys](https://sensecrypt.com/platform/resources/glossary/fido2-passkeys): A passkey is a phishing-resistant sign-in credential that replaces a password with a device-bound key pair. - [Liveness Detection](https://sensecrypt.com/platform/resources/glossary/liveness-detection): Liveness detection is a security check that confirms a real, live person is at the camera. - [Presentation Attack Detection (PAD)](https://sensecrypt.com/platform/resources/glossary/presentation-attack-detection): Presentation attack detection (PAD) is a method that finds and blocks fake biometric samples at a sensor. - [Face Tokenization](https://sensecrypt.com/platform/resources/glossary/face-tokenization): Face tokenization is a method that turns a face into a protected token, not a stored image. - [What is OpenID Connect (OIDC)?](https://sensecrypt.com/platform/resources/glossary/what-is-oidc): OpenID Connect (OIDC) is an identity layer on top of the OAuth 2.0 protocol. - [What is SAML 2.0?](https://sensecrypt.com/platform/resources/glossary/what-is-saml): SAML 2.0 is an open standard for single sign-on (SSO) between systems. - [What is SCIM?](https://sensecrypt.com/platform/resources/glossary/what-is-scim): SCIM is an open standard for user provisioning across systems. - [What is CIBA?](https://sensecrypt.com/platform/resources/glossary/what-is-ciba): CIBA is an authentication flow where the user approves a sign-in on a separate device. - [What is an identity provider (IdP)?](https://sensecrypt.com/platform/resources/glossary/what-is-an-identity-provider): An identity provider (IdP) is a service that checks who a user is. - [What is single sign-on (SSO)?](https://sensecrypt.com/platform/resources/glossary/what-is-sso): Single sign-on (SSO) is a method that lets a user sign in one time to reach many applications. - [What is customer identity and access management (CIAM)?](https://sensecrypt.com/platform/resources/glossary/what-is-ciam): Customer identity and access management (CIAM) is a system that manages sign in and access for customers. ## Developer docs - [Documentation](https://sensecrypt.com/idp-docs): The developer documentation for the SenseCrypt identity provider. - [Docs index for LLMs](https://sensecrypt.com/idp-docs/llms.txt): The machine-readable index of the developer documentation.