Self-hosted multi-factor authentication and action authorization
Need multi-factor authentication, or cryptographic proof of who approved what, without giving up data sovereignty or starting a multi-month project? Add it in a day and keep 100% control, on your own terms.
No time to read the details now? Give this to your AI agent — it’ll do the work for youRun it as a container and a database in any cloud, on-prem, or fully air-gapped. The auth path makes no outbound calls.
End users are opaque tokens — no name, email, or number. The deploying organization remains the sole controller of identity data.
Challenges stream straight from your server to the enrolled device. No APN or FCM for a platform vendor to throttle or observe.
No OIDC, SAML, or SSO. Keep your own users, sessions, and interface, and add the ceremony inside the products you already run.
Every approval is signed with a classical and a post-quantum key, both generated on the phone and never exported. On iPhone, both keys are held in the Secure Enclave. On Android, the classical key is held in the hardware-backed keystore. The post-quantum key is held there as well where the device supports ML-DSA (Android 17 and later), and otherwise in software, encrypted under a key in the hardware-backed keystore. Neither key can be restored onto another device.
The phone signs the exact details it shows. A spoofed or relayed request cannot change the amount, the payee or the action without the signature failing, and a used approval cannot be replayed.
Signatures pair Ed25519/P-256 with ML-DSA-65 — the scheme NIST standardized as FIPS 204 — and TLS uses a hybrid key exchange, designed to resist attack by future quantum computers, in line with EU guidance on post-quantum migration.
The phone proves it is a genuine device running the genuine app, through the platform's own attestation. Every approval also carries the level of check the phone performed — device unlock or biometric — signed into the response. The deployment refuses any approval below the level you asked for.
One command brings up the server and its database. Seed a demo relying party and approve a real request from the app.
Container and database — an L4 load balancer only if you want high availability. A self-hosted deployment typically takes one working day.
The API reference, the limits and the flat price are all public. No sales contact is needed to evaluate it.
Deployment as a service is available on request. Contact us.