On this page
The station never authenticates
The shared machine is treated as untrusted, because it is. It has no enrollment, holds no credential, and never runs a face check. All it does is show a QR code and hold open a live stream while it waits to be told who is standing at it.
The cryptography and the face check happen somewhere that belongs to exactly one person: their own enrolled phone. That phone is the trust anchor, and the station is a display.
The worker's own phone does the work
The worker scans the code with the companion app on their enrolled phone. The face check and the signing both run there, and only a single-use token results.
The station needs no enrollment, ever
You add a workstation by pointing it at the sign-in page. There is nothing to provision on it, no key to install, and nothing on it worth stealing.
One session, one named worker
Each sign-in ties to the individual who approved it, so the record answers who and not merely which terminal.
Handover takes seconds
Scan, face, in. No typing at the station, and no shared secret passed along with the shift.
What changes on the floor
Speed and accountability stop trading against each other. The handover is quicker than typing a password was, and the audit log finally names people.
There is a quieter benefit too. Because the station holds nothing, a compromised or stolen terminal gives an attacker no way into any account.
The audit log names a person
Every sign-in is recorded against the individual worker and the device that approved it, which is the record an investigation actually needs.
Nothing to steal at the station
No stored credential, no cached password, no enrollment. The terminal is a screen and a network connection.
Access follows the worker
SenseCrypt computes roles and permissions and emits them in the token, and your application enforces them. A worker gets the same access at whichever station they walk up to.
There is no shared code to overhear
Nothing is typed at the station and nothing is read out loud. A busy floor is a poor place to keep a secret, so this design does not ask it to.
Who it fits
This suits shift work on shared hardware: wards, production floors, checkout lanes, loading docks. The whole model rests on one assumption, and it is worth testing before anything else.
One dollar per user per month with a 20-seat minimum, and a 30-day trial that takes no card.
- Workforce single sign-on (SSO) teams.
- Shift teams on shared devices.
- Healthcare, retail, and manufacturing floors.
Frequently asked questions
What is shared workstation authentication?
It is sign-in on a device that many workers share. The shared station shows a QR code, and each worker approves on the companion app on their own enrolled phone. There is no shared password.
Does each worker get a separate audit record?
Yes. Each sign-in ties to one enrolled worker, and SenseCrypt records that sign-in.
Does SenseCrypt store a worker's face?
No. The face check runs on the worker's own phone. SenseCrypt stores no face image and no face template on the server.
Is a shared workstation sign-in phishing-resistant?
Yes. There is no shared password on the station, and no shared code to enter. Each worker approves on their own enrolled phone with a live face.
Related