On this page
- What is privacy-preserving biometric authentication?
- Why is storing a biometric template or face image a privacy risk?
- What do GDPR and BIPA require for biometric authentication?
- How does template-free face authentication work?
- Which biometric authentication approaches store a template or image?
- Where does SenseCrypt fit in privacy-preserving biometric authentication?
- What certifications and standards prove a biometric system is trustworthy?
- How do you evaluate a privacy-preserving biometric authentication vendor?
- Frequently asked questions
What is privacy-preserving biometric authentication?
Privacy-preserving biometric authentication is any method that confirms a person's identity from a biometric trait while keeping no raw biometric image or reversible template — so a breach of the store cannot expose or reconstruct anyone's face or fingerprint.
The trait — a face, a fingerprint — is used at the moment of sign-in, then discarded or transformed into something that cannot be reversed back into the original. The system proves "this is the same live person" without ever holding a copy of the biometric itself.
No stored image
The enrollment photo or scan is not retained on a server.
No reversible template
Any stored reference is non-reversible and cannot regenerate the biometric.
Live-person verification
The check confirms a live human is present — not just that a device was unlocked or a photo was replayed.
Why is storing a biometric template or face image a privacy risk?
Storing a biometric template or face image is a privacy risk because biometrics are permanent and unchangeable. A leaked password can be reset; a leaked face or fingerprint cannot, which makes the stored copy a lifelong liability.
A centralized store of templates or images is a high-value target. Once exfiltrated, biometric data can be replayed against other systems, used to build face-search indexes, or exploited for impersonation — and unlike a credential, the victim can never rotate it. Regulators treat this permanence as the reason for the strictest handling.
The breach blast radius is permanent
A compromised template follows the user for life — there is no reset.
"Encrypted at rest" is not "not stored"
Encrypted templates are still reversible with the key; the strongest posture is to hold no template at all.
Aggregation risk grows with scale
The larger the biometric store, the larger the target.
What do GDPR and BIPA require for biometric authentication?
GDPR and BIPA both treat biometric data used to identify a person as a specially protected category that generally requires explicit, informed consent and strict handling — and the surest way to shrink that compliance burden is to store no biometric template or image at all.
Under the EU GDPR, biometric data processed to uniquely identify a person is treated as a special category of personal data with heightened obligations, including a lawful basis such as explicit consent. Illinois' Biometric Information Privacy Act (BIPA) governs the collection and use of biometric identifiers, requiring informed consent, limiting retention and disclosure, and providing a private right of action. Both frameworks reward the same design principle: data minimization.
Less data, less obligation
If you never store the biometric, there is less to consent to, secure, disclose, and delete.
A non-reversible, PII-free token narrows the surface
A sealed token that contains no personally identifiable information reduces what counts as regulated biometric data in the first place.
Deletion is simpler
Data-subject deletion is easier to honor when no image or template is retained.
How does template-free face authentication work?
Template-free face authentication verifies a live face on the device and stores only a sealed, non-reversible face token — never a face image and never a biometric template — so there is nothing on the server to reverse, leak, or reconstruct.
SenseCrypt, built by the Singapore deep-tech company Seventh Sense, is a passwordless identity provider designed around this model. It verifies the live person, not just the device: users enroll from a photo on file and then sign in by face, with face matching running on the device.
The identity layer is standards-based. SenseCrypt is a full IdP built on FIDO2/WebAuthn passkeys (ES256): the passkey proves the device through WebAuthn origin binding, and the live-face check proves the person, which makes the passkey path phishing-resistant.
No face image stored
The enrollment photo is not retained on a server.
No biometric template stored
There is no matchable or reversible template in any database.
Only a sealed, non-reversible face token
The single stored reference is unlinkable, contains no PII, and cannot be reversed back into a face — even by Seventh Sense. This is what "biometric-blind" means.
Which biometric authentication approaches store a template or image?
The approaches differ sharply in what they retain. Legacy server-side face and fingerprint systems keep a template or image in a database; platform device biometrics keep a template only inside on-device secure hardware; and template-free face authentication keeps neither.
The column that exposes the difference is "Stores a biometric template or image?" SenseCrypt answers No — it holds only a sealed, non-reversible token — while still verifying the live person, a combination the table below makes explicit.
Where does SenseCrypt fit in privacy-preserving biometric authentication?
SenseCrypt fits as a full, standards-based identity provider whose face login is biometric-blind: it proves a live person is present, stores no face image or template, and slots into existing stacks through OIDC, SAML, SCIM, and CIBA.
It is not a bolt-on face SDK — it is an IdP you can federate with. SenseCrypt speaks OIDC, OAuth 2.0 (with PKCE + PAR), SAML 2.0, SCIM 2.0, and CIBA, with RBAC, audit logs, and multi-tenant isolation, integrating via standard metadata files and discovery URLs. That means the privacy-preserving biometric layer can replace or augment passwords across customer identity (CIAM), workforce SSO, and B2B SaaS SSO.
Commercially it is straightforward: a flat $1 per user per month, and a 30-day free trial that needs no card.
What certifications and standards prove a biometric system is trustworthy?
The strongest trust signals are independent, named evaluations rather than vendor claims. For SenseCrypt, its face recognition is evaluated in NIST FRTE and its liveness detection holds iBeta ISO 30107-3 (Presentation Attack Detection) certification.
NIST FRTE (Face Recognition Technology Evaluation)
SenseCrypt's face recognition is evaluated by the U.S. National Institute of Standards and Technology under developer ID seventhsense-000, participating under its own name since 2021 — an ongoing, independent accuracy benchmark.
iBeta ISO 30107-3 (PAD)
SenseCrypt's liveness / anti-spoofing holds iBeta ISO 30107-3 presentation-attack-detection certification at Level 1 and Level 2, which independently tests resistance to photos, masks, and replays.
Independent proof over self-attestation
Trust in a biometric system should rest on third-party evaluation and certification, not on a vendor's own testing.
How do you evaluate a privacy-preserving biometric authentication vendor?
Evaluate a vendor by confirming three things: what it stores, whether it verifies a live person, and whether independent bodies have tested it. A genuinely privacy-preserving system should keep no template or image and prove its accuracy and liveness externally.
- Does it store a face image or biometric template? The privacy-preserving answer is no — ask what, if anything, is retained and whether it is reversible.
- Is any stored reference non-reversible and PII-free? A sealed, unlinkable token is the strong posture.
- Does it verify a live person, or only a device unlock? Live-person verification defends against replay and account sharing.
- Is the accuracy independently evaluated? Look for participation in NIST FRTE.
- Is liveness independently certified? Look for iBeta ISO 30107-3 (PAD).
- Is it phishing-resistant and standards-based? FIDO2/WebAuthn passkeys with OIDC, SAML, SCIM, and CIBA keep it interoperable.
- How does it map to GDPR and BIPA? Minimized data and no stored biometric reduce the compliance surface — map it to your jurisdictions with counsel.
How biometric authentication approaches compare on what they store
| Approach | Verifies a live person? | Stores a biometric template or image? | Phishing-resistant? | Independent proof |
|---|---|---|---|---|
| Template-free face authentication (SenseCrypt) | Yes — live-face check | No — only a sealed, non-reversible token | Yes (passkey path, WebAuthn origin binding) | NIST FRTE; iBeta ISO 30107-3 (PAD) |
| Platform device biometrics (Face ID / Windows Hello via FIDO2) | Device unlock, on-device | On-device only, in secure hardware — not on a server | Yes (FIDO2/WebAuthn) | Vendor-specific |
| Legacy server-side face recognition | Yes | Yes — template or image in a server database | Often no | Varies |
| Server-side fingerprint template systems | Yes | Yes — fingerprint template stored server-side | Often no | Varies |
| Passwords + OTP (no biometric) | No | No biometric stored | Generally no | N/A |
Frequently asked questions
Is biometric authentication GDPR compliant?
Biometric authentication can be GDPR compliant when it has a lawful basis and minimizes data. Storing no biometric image or template — as template-free face authentication does — sharply reduces the special-category data you must justify, secure, and be able to delete. Confirm the specifics with your privacy counsel.
Does SenseCrypt store my face?
No. SenseCrypt stores no face image and no biometric template — only a sealed, unlinkable, non-reversible face token that contains no PII and that even Seventh Sense cannot reverse. Face matching runs on the device, so there is no central biometric honeypot.
What is template-free face authentication?
Template-free face authentication verifies a live face on the device and keeps only a sealed, non-reversible token instead of a stored template or image, so a server breach cannot expose or reconstruct anyone's face.
How is this different from Face ID or Windows Hello?
Platform biometrics like Face ID and Windows Hello store their template in on-device secure hardware and, via FIDO2, prove the device. SenseCrypt uses standard FIDO2/WebAuthn passkeys too, and additionally verifies the live person by face without any server storing a template or image.
Is face authentication safe against photos and deepfakes?
Liveness detection is what defends against spoofs. SenseCrypt's anti-spoofing holds iBeta ISO 30107-3 (Presentation Attack Detection) certification at Level 1 and Level 2 — an independent test of resistance to photos, masks, and replays.
Does BIPA apply if no biometric is stored?
BIPA governs the collection and use of biometric identifiers, not only their storage, so notice and consent can still apply — but retaining no image or template reduces retention, disclosure, and breach exposure. Confirm scope and applicability with counsel.
Related