Synapser Entry - Passwordless Biometric Identity Provider (OIDC)

Entry: True Human Identity Built on Zero Trust

Digital security has reached a critical turning point. While the industry has rushed toward biometric authentication, most implementations offer only the illusion of improved protection. By relying on client-side hardware and loaning trust to arbitrary smartphones, operating systems, and local authenticators, they create a dangerous vulnerability. When a remote device is compromised, the data it transmits back to your servers cannot be trusted.

Entry fundamentally changes this paradigm. Built on an uncompromising Zero Trust architecture, Entry removes trust from endpoint hardware entirely. Instead of asking a phone if an identity is valid, Entry captures the live session directly and conducts advanced 3D liveness detection and facial matching inside its secure cloud environment. The result is pure, verifiable human authenticity - no stored passwords, no transferable credentials, and zero exposure to synthetic replays or deepfake bypasses.

Built by Synapser (founded 2019) and an AWS partner with a completed Well-Architected Review, Entry runs on multi-AZ AWS infrastructure across all AWS regions, targeting 99.9% standard SaaS availability with higher contractual uptime commitments (99.95% or 99.99%) available through enterprise agreements. The platform has processed approximately 35,000 authentications and continues to scale.

Presentation Attack Detection: Tested under ISO/IEC 30107-3 metrics. In independent NIST NVLAP-accredited third-party testing by iBeta Quality Assurance (Lab Code 200962), the underlying liveness engine achieved 0% APCER - meaning zero successful presentation attacks across all tested species, including high-resolution 2D prints, digital screen replays, and realistic 3D silicone and latex masks. Conforms to iBeta PAD Level 1 and Level 2.

Facial Matching: Tunable match confidence thresholds. At the recommended 99% confidence threshold, FAR is less than 0.1% and TAR is greater than 99%. Raising the threshold to 99.9% drops FAR to less than 0.01%.

Cryptographic Security: RS256 token signing with AWS KMS backed by HSMs certified to FIPS 140-3 Security Level 3 by NIST CMVP, providing physical tamper resistance and zeroization mechanisms. Biometric templates are encrypted with AES-256-GCM and never touch relying-party servers.

• Zero Trust in the Device: The connecting camera or device is treated strictly as an untrusted input lens. Liveness verification and biometric evaluation occur entirely server-side, eliminating client-side tampering vectors.

• One Lifetime Registration with Non-Federated Consent: Users register their biometric profile once for life. To access a new application, they simply provide explicit consent. One physical face permanently maps to one verified subject identifier, preventing duplicate personas and enabling true cross-system fraud prevention.

• Credential-Free and Replay-Proof: Entry eliminates usernames, passwords, and static seed keys. With nothing static transmitted across the wire, intercepted network data cannot be weaponized or replayed.

• Standard OIDC Drop-In Integration: Entry functions as a standard OpenID Connect Identity Provider using Authorization Code flow with mandatory PKCE (S256). Developers integrate in 15 to 30 minutes using 10 to 30 lines of configuration code with standard libraries including oidc-client-ts, next-auth, openid-client, AppAuth (iOS/Android), and flutter_appauth. No proprietary SDK required.

• Enterprise Privacy and HSM Token Signing: Biometric templates never leave the isolated vault. Identity tokens are cryptographically signed using AWS KMS hardware security modules certified to FIPS 140-3 Security Level 3.

Financial Services Step-Up Authentication: A banking customer signs in to their web or mobile application using only their face - no username or password required. When a high-risk transaction exceeds a defined threshold (such as a large wire transfer or payee change), Entry triggers an instant biometric step-up challenge. The 3D liveness check and facial match execute server-side in seconds, confirming the authenticated human is still present. This flow helps institutions address strong customer authentication requirements while eliminating credential-based attack surfaces such as phishing, SIM-swapping, and password reuse.

Workforce and Physical Access Verification: Organizations managing secure facilities or shift-based workforces deploy Entry as a biometric attendance and access checkpoint. Employees authenticate at a kiosk or mobile device using a live facial scan. Because liveness detection runs server-side, the checkpoint device requires only a camera - no specialized biometric hardware.