Passwordless identity platform

Six pillars on the same technological core.

location intelligence

Analysis of the radio environment to determine whether the user is within a safe zone. Detects location spoofing and blocks out-of-context access.

Passwordless identity and access

Device authentication (computer, mobile phone, USB, smartcard) with standard protocols to integrate with existing systems.

Behavior-based fraud detection

Behavior monitoring, transaction analysis, and location correlation to identify anomalies in real time.

Advanced security and compliance

Mutual authentication, encryption, and audit aligned with PSD2, DORA, NIS2, and ENS.

Identity centralization

Users, devices, policies, and monitoring in a single console, integrating Active Directory, Entra ID, Google Cloud Identity, or LDAP.

Ease of use

Simple integration, even agentless. On-premise, cloud, or hybrid deployment, and minimal maintenance.

What each method checks, workstation by workstation.

The same policy works for employees with a phone, those who share a workstation on the plant floor, and vendors who log in once a month.

Method	For who	How it's verified	Location
Mobile app	Employees with a personal or company phone	Notification on the phone, fingerprint or face, and location signature, all in one tap	With location signature
Desktop app	Offices where phones aren't allowed	Key stored on the computer itself plus a time-based code	With location signature
Passkeys and FIDO2	Web services and devices with a physical key	Cryptographic credential that doesn't travel to the server, with device biometrics	With location signature
Facial recognition	Workstations where you don't want to touch anything	The device or phone camera, tied to that specific device	With location signature
USB token	Clean rooms, plant floor, and environments without biometrics	The key is split between the token and the computer: both are needed	With location signature
NFC / RFID card	Shifts and shared workstations	The same access badge, held up to a reader	With location signature
Magic Link / SMS	Collaborators who log in occasionally	Link or code that expires after one use	Location optional
Agentless	Servers and devices that don't allow installations	The source network and credential they already use, evaluated on the server	With location signature

With location signature Location optional

Corporate geofencing

A head office, data center, or home: each zone with its own requirements

Zones are grouped into policies, and each policy is assigned to applications, groups, or resources. The administrator decides what can be done inside and what happens outside.

Entire buildings or a single floor, the data center, and homes where people work remotely.
Standard verification using radio signals, or strict verification using GPS and radio environment at the same time.
Valid for remote desktops, SSH servers, and web applications alike.
In Premium, plus, each person's usual places learn themselves.

ITDR on every access

The right credential from the wrong place is already an alert

Authentication solves the first second. Ironchip ITDR scores every access attempt with its context (place, network, device, and behavior) and responds in real time, before a compromised identity becomes an incident.

Risk per accessClean, suspicious or fraud, with the score that justifies it
Location and networkCoordinates, IP, VPN, TOR, proxy and the user's usual places
Device integrityRoot, jailbreak, emulator, active debugging and detected malware
Response and SIEMAutomatic block, administrator alert and correlatable event

Beyond the browser: the device, the network, and your own applications.

The same policy protects your computer login, VPN, and custom-built applications, not just the web portal.

09:12Tuesday, October 7

Ane · FinanceCorporate team

Approve access on your phone

Registered device
Bilbao head office · recognized signature

Session started without password

Device loginSecond factor when starting your computer on Windows, Linux, and macOS. On Windows, also passwordless with Kerberos certificates.

Desktop authenticatorsThe Ironchip authenticator for Windows, Linux, and macOS, and the RFID reader for shared workstations.

VPN and network accessRADIUS and NPS, also passwordless, LDAP and ADFS: the same control for your VPN, corporate wifi, and network infrastructure.

Custom applicationsAPI keys and HTTP MFA to add Ironchip verification to any internal application.

Directory password as another factorChecked in real time against Active Directory or LDAP and combined with the rest, for seamless migration.

Account recoveryIf someone loses or changes their phone or FIDO2 key, they recover access without support having to manually reset anything.

Dynamic rules: you decide what is a threat.

The administrator defines what counts as a threat, how much it weighs and what happens when detected. No code changes and no waiting for a new version.

Combinable conditionsMultiple conditions and groups on network, device, location and behavior.

Graded riskFrom Clear 0 to Fraud 100. The access takes the highest risk, never the sum.

Automatic actionDeny immediately and, if appropriate, block the user until someone reviews it.

Analyst reportCategory, label and the phrase that whoever investigates the event will read.

Ruleset8 of 8 active rules · Entire company

Add detection

Rule	Detects	Risk	Action
Tor network	the connection comes from the Tor network	Fraud · 100	Deny
IPs from different countries	connections come from different countries	High · 50	Additional factor
VPN network	the connection goes through a VPN, a proxy or hosting	Low · 10	Log
Tampered device	the phone has root or jailbreak	Fraud · 100	Deny
Known device	the phone is already registered for the user	Clear · 0	Allow
Usual location	at least 10 previous operations from this place	Clear · 0	Allow
On call	the user is on a phone call	High · 50	Additional factor
Spoofed GPS	the location is being manipulated	Fraud · 100	Deny

Example ruleset in the Ironchip console. Unlimited and customizable rules per company; adaptive engine and forensic capability in the Premium edition.

Rule · Access from anonymous network outside zone

Network is VPN, TOR or proxy
and location outside the user's zones
and application with critical level

Risk85 · Suspicious

Clear 0SuspiciousFraud 100

Action Deny access and block the user.

Report "Critical access from anonymous network and unusual place".

Rule · New device outside business hours

Device not registered for the user
and access between 22:00 and 06:00
and location within the user's usual zone

Risk40 · Medium

Clear 0SuspiciousFraud 100

Action Request an additional factor and alert the administrator.

Report "First access from a new device outside normal business hours".

Two rules created from the editor with the same pieces: conditions, risk, action and report.

And when an alert fires

Real-time threat feedConfirmed and suspicious attempts, with VPN, Tor, hosting networks, and malware already identified.

Investigation and casesAccess forensics and case management to track each incident until closed.

Behavior explainedWhy a user or device is considered suspicious, explained in natural language, and recommended rules based on your organization's activity.

Use case · Third parties and vendors

The vendor enters your critical infrastructure. You know who they are, from where and until when.

Maintenance, integrators, remote support, consultancies: third parties are today the most common entry point. They use their own equipment, don't have corporate phones and their accounts remain active when the contract ends. NIS2 and DORA already require controlling that supply chain risk.

Without installing anything on their equipment. Single-use Magic Link, SMS or agentless access.
Only from where they should be. Their office or your plant as a safe zone; a stolen credential is useless from anywhere else.
Access with expiration date. Permissions per resource and time window; when done, it closes automatically.
RDP, SSH and VPN too. The policy covers servers and OT, not just web applications.
Every action, by name. No shared accounts: each technician with their identity and their event in the SIEM.
Audit evidence. Who entered, from where, to what and for how long, ready for NIS2, DORA, ENS and ISO 27001.

Use case · NFC / RFID card

Industrial plant or hospital plant: shifts, shared workstations and no phones.

In factories and hospital plants there's no corporate phone, gloves prevent biometrics and three shifts share the same terminal. The password ends up on a sticky note and nobody knows who did what.

The card they already carryThe access control credential serves to enter the system: bringing it close to the reader is the complete gesture
The plant is the safe zoneA lost or cloned card is useless outside the facility
Traceability per personEach access with its named user, even though the terminal is shared

The same pattern solves retail, logistics and customer service. When there's no reader either, the USB token with split key between equipment and user covers the scenario.

It connects to the directory you already have and the applications you already use.

Additions, deletions, and role changes arrive from your directory without manual steps. It deploys on your servers, in the cloud, or both, and can protect devices where nothing is installed.

Identity source	Mechanism	What it solves
Active Directory on-premise	ADConnect	Secure and automatic integration of the local directory, with real-time synchronization
Entra ID / Azure AD	SCIM	Immediate provisioning and deprovisioning from the cloud IdP
Google Cloud Identity	SCIM / OIDC	Unified identity for organizations with Google stack
Local users	CSV import	Spot onboarding, groups without directory and third parties
Applications and services	OIDC, SAML, RADIUS, SDK	More than 5,000 enterprise applications, cloud services and productivity tools; also RDP and SSH

Designed for the person who manages it every day.

Multiple organizations at onceMultiple Entra ID in the same organization and a partner console to manage customer companies with their licenses.

Role-based permissionsEach administrator sees and changes only theirs, and the console can be limited to your network's IPs.

Logging and metricsEvery authentication and every change, with usage metrics and event delivery to SIEM.

Reusable policiesDevice, safe zone, and password policies that combine by application and group.

Basic, Enterprise, and Premium.

Each plan includes the previous one. They are a starting point: any module can be enabled and configured for your organization.

Module	Basic	Enterprise	Premium
Authentication
Ironchip app passwordless, with location	Included	Included	Included
SMS, email, and magic link	Included	Included	Included
OTP codes	Included	Included	Included
FIDO2 keys and passkeys	Included	Included	Included
Account recovery	Included	Included	Included
Facial recognition	Not included	Included	Included
Directory password as a factor	Not included	Included	Included
USB keys and RFID cards	Not included	Included	Included
safe zones	Not included	Included	Included
Access policies	Included	Included	Included
Integrations
SSO with OIDC and SAML	Included	Included	Included
Login on Windows, Linux, and macOS	Included	Included	Included
Desktop and RFID authenticators	Not included	Included	Included
RADIUS, LDAP, and ADFS	Not included	Included	Included
API and HTTP MFA	Not included	Included	Included
Directory and operations
Users, groups, and devices	Included	Included	Included
Provisioning from Entra ID, SCIM, and AD Connect	Not included	Included	Included
Multi-organization and partner console	Not included	Included	Included
Roles, IP whitelist, and white-label	Included	Included	Included
Logging and metrics	Included	Included	Included
SIEM delivery	Not included	Included	Included
Detection and response (ITDR)
Threat feed and identity fraud	Not included	Not included	Included
Rules editor	Not included	Not included	Included
Forensic investigation and cases	Not included	Not included	Included
Behavior explained and recommended rules	Not included	Not included	Included
Other products
Phishing Shield	Not included	Not included	Included
Privileged access (PAM)	Not included	Not included	Included

Named user license: one person can have multiple aliases, devices, and applications without counting as an additional user. Premium includes dedicated 24/7 support.

Frequently asked questions about the identity platform

How do I add MFA to workstations without a corporate phone?

With a method that does not depend on the phone: NFC or RFID card in a reader, USB token with split key between token and workstation, or Ironchip's desktop authenticator. All three can also require access from the workstation's safe zone.

What happens if an employee's password or passkey is stolen?

It does not work for the attacker. In addition to the credential, access requires the registered device and, if policy demands, the radio signature of the place matches a safe zone. A valid credential used from another place is blocked and generates an alert.

Does Ironchip replace my identity provider?

No. Ironchip connects to Active Directory, Entra ID, Google Cloud Identity or LDAP as a user source and protects applications via OIDC, SAML, RADIUS or its API. It can function as an IdP or add its verification to the one you already use.

Is employee location recorded?

Coordinates or movement history are not stored. A place's signature is anonymous, cannot be converted into an address, and is only compared at the moment of access.

Does it help comply with ENS, NIS2 and DORA?

Yes. Ironchip is in the CCN CPSTIC catalog at HIGH level, has LINCE certification and ENS certification in the high category, and logs who accesses, from where, and with what device, with the evidence required by audits.

Start with a critical application and a group of users.

Without replacing your current systems and with measurable results from the first week.

Request a pilot Technical documentation

What we need for the pilot

Test access to your IdP or directory
One critical application to protect first
A small group of users with different workstations
The head offices or zones you want to declare

Passwordless identity platform.