Service 02 · Compliant auth systems

Authentication your assessor can verify, not just take on faith.

We design, build and operate the authentication system underneath your agency, on infrastructure that belongs to you alone, and we document it the way an auditor, an insurer or a grant administrator actually asks for.

No NDA to read the code, no NDA to sit in the review. If your security staff want to pick it apart before anyone talks about money, that is the correct order.

the questions an assessor opens with
Common assessor questions and our answers
passwords supported?no. none. no fallback.
SMS or email OTP?no. phishable by definition.
who else is in our database?nobody. it is yours.
can we read the code?yes. before you buy. no NDA.
can we leave?yes. open source, documented export.
Architecture

The difference is where your users live.

This is the one architectural decision that changes your answer to "what happens to us when the vendor has a bad day."

the common model · shared identity pool
one directory, one operatoryour agencytenant 002tenant 003shared control plane and datastoreone compromise reaches many agencies

A tenant boundary is a software control, and software controls fail. Your blast radius ends up set by the operator's worst customer and the operator's worst day, neither of which you can see or influence.

how we build · dedicated instance
your agency onlyauth serviceyour databaseanother agencyauth servicetheir databaseno shared path between them

Nothing your agency depends on is reachable from another customer's environment, because there is not one in it. The isolation is structural rather than a policy someone has to keep enforcing correctly.

NIST SP 800‑63B

Which authenticators we support, at which assurance level.

This is the table your assessor will want, so we publish it rather than making them ask. It says what each authenticator type is, and it says plainly where a claim depends on how your agency configures things rather than on us.

Assurance level is a property of the whole system, not a badge a product can wear on its own. Anyone who tells your agency their product "is AAL3" is skipping that sentence.

Authenticator types, whether each is phishing-resistant, and whether we support it
AuthenticatorPhishing-resistantSupportedNotes
FIDO2 roaming security keyYesYesOur default for staff without agency devices
Device-bound platform passkeyYesYesDefault on managed agency hardware
Synced passkeyYesConfigurablePhishing-resistant, but syncs through a consumer account. Your agency decides; we default it off.
Authenticator-app TOTPNoNoRelayable by an attacker-in-the-middle proxy
Push approvalNoNoDefeated by prompt fatigue
SMS or email OTPNoNoAlso exposed to SIM swap and mailbox takeover
Password, any formNoNoThere is no password column in the schema
Threat model

What this fixes, and what it does not.

Phishing-resistant authentication is not a security program. Anyone who tells your agency otherwise is selling you something.

closed

Credential phishing and AiTM relay

A passkey signature is bound to the real origin. A proxy between your employee and a lookalike page gets a signature it cannot replay anywhere useful.

closed

Reuse, spraying and dumped passwords

There is no shared secret in the database to steal, crack, or reuse from a breach at some unrelated service your employee also used.

reduced, not closed

Help-desk social engineering

Once the login stops being phishable, attackers call the help desk instead. We design the recovery flow with you and write it down. A product cannot close this one on its own.

reduced, not closed

Session theft after sign-in

Stealing a live session sidesteps the login entirely. Session lifetimes, re-authentication rules and device binding help; they do not eliminate it, and we will not claim they do.

The evidence package

Compliance work is mostly proving it, not doing it.

Agencies rarely fail an audit because the control is missing. They fail because nobody can produce the evidence for it in the two weeks they were given. So this service is built to produce the evidence continuously rather than in a panic each spring.

Three audiences ask, and they ask for different things. We keep the artifacts for all three.

For your auditor

The control narrative for authentication, the 800‑63B mapping for your configuration, and exportable authentication and admin event history covering the period they asked about.

For your insurer

Carriers ask what form of MFA an agency runs, and the answer changes the questionnaire. We write the authentication section of your renewal, in their language, with the coverage figures your own system reports.

For your grant administrator

Where cybersecurity grant money funded the work, reporting usually wants a before-and-after picture. The annual posture report is built to be that picture, with the same methodology each year so the comparison is real.

Free, no NDA

Put your security team in a room with ours.

Ninety minutes, source open on the screen, your assessor asking whatever they want. If we cannot answer something we will say so in the room rather than follow up later with a better-worded version of the same gap.