We design, build and operate the authentication system underneath your agency, on infrastructure that belongs to you alone, and we document it the way an auditor, an insurer or a grant administrator actually asks for.
No NDA to read the code, no NDA to sit in the review. If your security staff want to pick it apart before anyone talks about money, that is the correct order.
| passwords supported? | no. none. no fallback. |
|---|---|
| SMS or email OTP? | no. phishable by definition. |
| who else is in our database? | nobody. it is yours. |
| can we read the code? | yes. before you buy. no NDA. |
| can we leave? | yes. open source, documented export. |
This is the one architectural decision that changes your answer to "what happens to us when the vendor has a bad day."
A tenant boundary is a software control, and software controls fail. Your blast radius ends up set by the operator's worst customer and the operator's worst day, neither of which you can see or influence.
Nothing your agency depends on is reachable from another customer's environment, because there is not one in it. The isolation is structural rather than a policy someone has to keep enforcing correctly.
This is the table your assessor will want, so we publish it rather than making them ask. It says what each authenticator type is, and it says plainly where a claim depends on how your agency configures things rather than on us.
Assurance level is a property of the whole system, not a badge a product can wear on its own. Anyone who tells your agency their product "is AAL3" is skipping that sentence.
| Authenticator | Phishing-resistant | Supported | Notes |
|---|---|---|---|
| FIDO2 roaming security key | Yes | Yes | Our default for staff without agency devices |
| Device-bound platform passkey | Yes | Yes | Default on managed agency hardware |
| Synced passkey | Yes | Configurable | Phishing-resistant, but syncs through a consumer account. Your agency decides; we default it off. |
| Authenticator-app TOTP | No | No | Relayable by an attacker-in-the-middle proxy |
| Push approval | No | No | Defeated by prompt fatigue |
| SMS or email OTP | No | No | Also exposed to SIM swap and mailbox takeover |
| Password, any form | No | No | There is no password column in the schema |
Phishing-resistant authentication is not a security program. Anyone who tells your agency otherwise is selling you something.
A passkey signature is bound to the real origin. A proxy between your employee and a lookalike page gets a signature it cannot replay anywhere useful.
There is no shared secret in the database to steal, crack, or reuse from a breach at some unrelated service your employee also used.
Once the login stops being phishable, attackers call the help desk instead. We design the recovery flow with you and write it down. A product cannot close this one on its own.
Stealing a live session sidesteps the login entirely. Session lifetimes, re-authentication rules and device binding help; they do not eliminate it, and we will not claim they do.
Agencies rarely fail an audit because the control is missing. They fail because nobody can produce the evidence for it in the two weeks they were given. So this service is built to produce the evidence continuously rather than in a panic each spring.
Three audiences ask, and they ask for different things. We keep the artifacts for all three.
The control narrative for authentication, the 800‑63B mapping for your configuration, and exportable authentication and admin event history covering the period they asked about.
Carriers ask what form of MFA an agency runs, and the answer changes the questionnaire. We write the authentication section of your renewal, in their language, with the coverage figures your own system reports.
Where cybersecurity grant money funded the work, reporting usually wants a before-and-after picture. The annual posture report is built to be that picture, with the same methodology each year so the comparison is real.
Ninety minutes, source open on the screen, your assessor asking whatever they want. If we cannot answer something we will say so in the room rather than follow up later with a better-worded version of the same gap.