On this page
Enterprise SSO is a gate, not a feature
Enterprise buyers do not evaluate single sign-on. They require it. The security questionnaire asks whether you support SAML 2.0 and OIDC, whether provisioning is automatic, and whether their identity team keeps lifecycle control, and a no on any of those can end the conversation before pricing starts.
Building it yourself is not a sprint, it is a permanent commitment: SAML edge cases, metadata handling, key rotation, per-tenant key custody, and an audit story you have to defend to somebody else's auditor. SenseCrypt ships that as the identity layer your product fronts, so the questionnaire stops being an engineering roadmap.
The protocol answers are already yes
SAML 2.0 with signed assertions, plus OIDC and OAuth 2.0 with PKCE and pushed authorization requests. You fill the section in rather than scheduling the work behind it.
Provisioning is the follow-up question
At around a thousand seats, manual user management is unacceptable to any IT organization, which is why SCIM 2.0 sits immediately behind SAML in the same questionnaires.
Key custody is what teams underestimate
Per-tenant signing keys have to be generated, rotated, and for some buyers held so they cannot be exported at all. That is a custody and operations problem, not a crypto library problem.
Skip the SSO tax
The industry habit is to lock single sign-on behind the most expensive tier, which the market has come to call the SSO tax: the control buyers need most, priced as a luxury. SenseCrypt's per-user rate does not move when you turn security on, so offering enterprise sign-in to your customers does not force you to rebuild your own pricing around it.
One dollar per user per month
That is the list rate, with a 20-seat minimum. Customer identities bill as monthly active users, so accounts that do not sign in during the month do not bill.
Security is not a tier
SAML, SCIM, CIBA, role-based access control and audit logs are in that rate. There is no security edition to upgrade into when a buyer asks for the thing they should always have had.
The trial is the whole product
Thirty days, full feature set, no card. You can answer a live security questionnaire before you commit a budget line.
A tenant per customer, isolated by cryptography
Multi-tenancy in a B2B product usually means a column in a table and a lot of faith in the middleware. SenseCrypt draws the line lower down: each of your business customers is its own tenant, with its own issuer and its own signing keys. A token minted for one tenant does not fail a filter somewhere else, it fails signature validation. That is a better sentence for a security review than any policy you can write, because it does not depend on a code path being correct.
Branding follows the same boundary. Each tenant serves its sign-in surface from its own verified custom domains, up to 25 of them, so your customer's employees authenticate on a page that looks and reads like the product they bought rather than like ours.
- Per-tenant issuers, signing keys and discovery documents.
- Per-tenant branding served from verified custom domains.
- Key custody per tenant, including non-exportable managed keys.
Give each customer's IT team the keys
Enterprise buyers want lifecycle control in their own hands, and your engineers want it out of theirs. Delegated administration per tenant gives the customer's IT team its own users, groups and roles without raising a ticket with you, which removes the support path that scales worst as you add logos.
Provisioning runs over SCIM 2.0 with per-tenant tokens, so their directory stays the source of truth and your product follows it.
Their directory creates and removes accounts
Users, groups, filters and bulk operations, driven from the system their IT team already runs. Your product is not the place a leaver gets forgotten.
Departure is immediate
Deprovisioning severs device keys and sessions in one step rather than marking a row inactive and hoping the session expires.
Administrative change is evidence
Every console change appends to a tamper-evident audit trail, and person-level activity exports to CSV. That export is what their auditor will actually ask you for.
Passwordless for their whole workforce
The people signing in are your customer's employees, and they get the same ceremony as everyone else on SenseCrypt: enrollment from a photo on file or through self-signup gated to the customer's email domains, then face sign-in from their own phone onto whatever device is in front of them.
This is the part that changes the security review rather than merely passing it. You are not offering single sign-on with the same phishable secret still sitting behind it. There is no password to stuff and no code to read out, which is the reason the flow resists phishing at all.
The match runs on the employee's device
Capture and face matching happen on their own phone. The server keeps no face image and no face template, only a sealed single-use face token, and the tokenization is patent-pending.
Liveness is certified, recognition is evaluated
Liveness holds iBeta ISO/IEC 30107-3 certification at Level 1 and Level 2, which covers presentation attacks at the camera. Face recognition entered the NIST evaluation in 2021, then FRVT and later split into FRTE and FATE, and is maintained through our latest submissions. That is evaluation, not certification.
A PIN appears once, at binding
Binding a new phone uses a one-time PIN sent to the mailbox, and by SMS when a mobile number is on file. Sign-in itself never asks for a code, which is exactly why there is nothing to phish.
Usage-based billing that follows your growth
Billing follows the shape of your business rather than a tier sheet, and a 30-day full-feature trial takes no card. Workforce seats bill on the period's high-water mark, and external users bill as monthly active users in arrears, so a customer's dormant accounts are not a line item you have to explain to anybody.
Two numbers decide your cost model: how many people actually sign in, and how many branded tenants and domains you run. The first tracks your revenue closely. The second does not, so size it against your expected customer count before you commit to a tenant-per-logo design.
Seats bill at the high-water mark
Workforce seats are charged on the period's peak, so adding staff mid-month does not turn into a reconciliation exercise at renewal.
External users bill in arrears
Customer identities are counted as monthly actives after the fact. The ones that never signed in are not on the invoice.
Enabling security never repriced a deal
Nothing in the rate changes when a buyer asks for SCIM, SAML or backchannel approvals, so a security requirement does not become a margin conversation.
The enterprise readiness checklist, answered
| What the questionnaire asks | How SenseCrypt answers |
|---|---|
| Do you support SAML 2.0? | Yes, with signed assertions, SP- and IdP-initiated SSO, and optional encrypted assertions |
| Do you support OIDC and OAuth 2.0? | Yes, authorization code with PKCE only, plus PAR and CIBA |
| Is provisioning automatic? | Yes, SCIM 2.0 users and groups with per-tenant tokens; deprovisioning severs access immediately |
| Are customers isolated? | Every tenant is its own issuer with its own signing keys; cross-tenant tokens fail cryptography |
| Can we use our own domain? | Up to 25 verified custom domains per tenant, serving only the sign-in surface |
| Is there an audit trail? | Person-level activity with CSV export, plus a tamper-evident chain over administrative changes |
Frequently asked questions
How does SenseCrypt keep tenants separate?
Every tenant is its own issuer with its own signing keys and discovery documents. A token minted for one tenant fails signature validation everywhere else, and tenant key material can be held as non-exportable managed keys.
Does SenseCrypt offer enterprise SSO?
Yes. Your application fronts SenseCrypt over OIDC or SAML 2.0, and each business customer gets a tenant with its own users, branding, domains, and delegated administration.
Is there a pre-built connector for my stack?
SenseCrypt is standards-based rather than connector-based: any application that speaks OIDC, SAML 2.0, or SCIM 2.0 connects with metadata files and discovery URLs.
Do you charge extra for SSO?
No. SSO, SCIM, and every other capability are included in the flat price of one dollar per user per month.
What does onboarding a new enterprise customer look like?
Create their tenant, apply their branding and custom domain, hand their IT team a SCIM token and delegated admin access, and their directory takes it from there. Their employees enroll from photos on file or through domain-gated self-signup.
What does SenseCrypt cost?
One dollar per user per month, list price, with a 20-seat minimum. Volume discounts apply at scale, and a 30-day trial needs no card.
Related