# Passwordless identity platform. > Passwordless IAM with safe zones, ITDR, dynamic rules, and an authentication method for each workstation, also phone-free. URL: https://www.ironchip.com/en/identity-platform Product · Identity and access Every access checks who you are, what device you're using, and where you're logging in from. No passwords to leak, no codes to intercept, and it sits on top of the directory and IdP your team already manages. [Request a pilot](https://www.ironchip.com/en/talk-sales?producto=Location-Based%20Authentication#hs-demo-form) See the methods _Real-time context evaluation._ ## Six pillars on the same technological core. ### location intelligence Analysis of the radio environment to determine whether the user is within a safe zone. Detects location spoofing and blocks out-of-context access. ### Passwordless identity and access Device authentication (computer, mobile phone, USB, smartcard) with standard protocols to integrate with existing systems. ### Behavior-based fraud detection Behavior monitoring, transaction analysis, and location correlation to identify anomalies in real time. ### Advanced security and compliance Mutual authentication, encryption, and audit aligned with PSD2, DORA, NIS2, and ENS. ### Identity centralization Users, devices, policies, and monitoring in a single console, integrating Active Directory, Entra ID, Google Cloud Identity, or LDAP. ### Ease of use Simple integration, even agentless. On-premise, cloud, or hybrid deployment, and minimal maintenance. ## What each method checks, workstation by workstation. The same policy works for employees with a phone, those who share a workstation on the plant floor, and vendors who log in once a month. | Method | For who | How it's verified | Location | |---|---|---|---| | Mobile app | Employees with a personal or company phone | Notification on the phone, fingerprint or face, and location signature, all in one tap | With location signature | | Desktop app | Offices where phones aren't allowed | Key stored on the computer itself plus a time-based code | With location signature | | Passkeys and FIDO2 | Web services and devices with a physical key | Cryptographic credential that doesn't travel to the server, with device biometrics | With location signature | | Facial recognition | Workstations where you don't want to touch anything | The device or phone camera, tied to that specific device | With location signature | | USB token | Clean rooms, plant floor, and environments without biometrics | The key is split between the token and the computer: both are needed | With location signature | | NFC / RFID card | Shifts and shared workstations | The same access badge, held up to a reader | With location signature | | Magic Link / SMS | Collaborators who log in occasionally | Link or code that expires after one use | Location optional | | Agentless | Servers and devices that don't allow installations | The source network and credential they already use, evaluated on the server | With location signature | Corporate geofencing ### A head office, data center, or home: each zone with its own requirements Zones are grouped into policies, and each policy is assigned to applications, groups, or resources. The administrator decides what can be done inside and what happens outside. - Entire buildings or a single floor, the data center, and homes where people work remotely. - Standard verification using radio signals, or strict verification using GPS and radio environment at the same time. - Valid for remote desktops, SSH servers, and web applications alike. - In Premium, plus, each person's usual places learn themselves. ITDR on every access ### The right credential from the wrong place is already an alert Authentication solves the first second. Ironchip ITDR scores every access attempt with its context (place, network, device, and behavior) and responds in real time, before a compromised identity becomes an incident. - **Risk per access**: Clean, suspicious or fraud, with the score that justifies it - **Location and network**: Coordinates, IP, VPN, TOR, proxy and the user's usual places - **Device integrity**: Root, jailbreak, emulator, active debugging and detected malware - **Response and SIEM**: Automatic block, administrator alert and correlatable event ## Beyond the browser: the device, the network, and your own applications. The same policy protects your computer login, VPN, and custom-built applications, not just the web portal. _Windows login example protected with Ironchip._ **Device login**: Second factor when starting your computer on Windows, Linux, and macOS. On Windows, also passwordless with Kerberos certificates. **Desktop authenticators**: The Ironchip authenticator for Windows, Linux, and macOS, and the RFID reader for shared workstations. **VPN and network access**: RADIUS and NPS, also passwordless, LDAP and ADFS: the same control for your VPN, corporate wifi, and network infrastructure. **Custom applications**: API keys and HTTP MFA to add Ironchip verification to any internal application. **Directory password as another factor**: Checked in real time against Active Directory or LDAP and combined with the rest, for seamless migration. **Account recovery**: If someone loses or changes their phone or FIDO2 key, they recover access without support having to manually reset anything. ## Dynamic rules: you decide what is a threat. The administrator defines what counts as a threat, how much it weighs and what happens when detected. No code changes and no waiting for a new version. **Combinable conditions**: Multiple conditions and groups on network, device, location and behavior. **Graded risk**: From Clear 0 to Fraud 100. The access takes the highest risk, never the sum. **Automatic action**: Deny immediately and, if appropriate, block the user until someone reviews it. **Analyst report**: Category, label and the phrase that whoever investigates the event will read. **Ruleset**: 8 of 8 active rules · Entire company Add detection | Rule | Detects | Risk | Action | |---|---|---|---| | Tor network | the connection comes from the Tor network | Fraud · 100 | Deny | | IPs from different countries | connections come from different countries | High · 50 | Additional factor | | VPN network | the connection goes through a VPN, a proxy or hosting | Low · 10 | Log | | Tampered device | the phone has root or jailbreak | Fraud · 100 | Deny | | Known device | the phone is already registered for the user | Clear · 0 | Allow | | Usual location | at least 10 previous operations from this place | Clear · 0 | Allow | | On call | the user is on a phone call | High · 50 | Additional factor | | Spoofed GPS | the location is being manipulated | Fraud · 100 | Deny | Example ruleset in the Ironchip console. Unlimited and customizable rules per company; adaptive engine and forensic capability in the Premium edition. Rule · Access from anonymous network outside zone - Network is VPN, TOR or proxy - and location outside the user's zones - and application with critical level Risk **85 · Suspicious** **Action**: Deny access and block the user. **Report**: "Critical access from anonymous network and unusual place". Rule · New device outside business hours - Device not registered for the user - and access between 22:00 and 06:00 - and location within the user's usual zone Risk **40 · Medium** **Action**: Request an additional factor and alert the administrator. **Report**: "First access from a new device outside normal business hours". Two rules created from the editor with the same pieces: conditions, risk, action and report. ### And when an alert fires **Real-time threat feed**: Confirmed and suspicious attempts, with VPN, Tor, hosting networks, and malware already identified. **Investigation and cases**: Access forensics and case management to track each incident until closed. **Behavior explained**: Why a user or device is considered suspicious, explained in natural language, and recommended rules based on your organization's activity. Use case · Third parties and vendors ### The vendor enters your critical infrastructure. You know who they are, from where and until when. Maintenance, integrators, remote support, consultancies: third parties are today the most common entry point. They use their own equipment, don't have corporate phones and their accounts remain active when the contract ends. NIS2 and DORA already require controlling that supply chain risk. - **Without installing anything on their equipment.** Single-use Magic Link, SMS or agentless access. - **Only from where they should be.** Their office or your plant as a safe zone; a stolen credential is useless from anywhere else. - **Access with expiration date.** Permissions per resource and time window; when done, it closes automatically. - **RDP, SSH and VPN too.** The policy covers servers and OT, not just web applications. - **Every action, by name.** No shared accounts: each technician with their identity and their event in the SIEM. - **Audit evidence.** Who entered, from where, to what and for how long, ready for NIS2, DORA, ENS and ISO 27001. Use case · NFC / RFID card ### Industrial plant or hospital plant: shifts, shared workstations and no phones. In factories and hospital plants there's no corporate phone, gloves prevent biometrics and three shifts share the same terminal. The password ends up on a sticky note and nobody knows who did what. - **The card they already carry**: The access control credential serves to enter the system: bringing it close to the reader is the complete gesture - **The plant is the safe zone**: A lost or cloned card is useless outside the facility - **Traceability per person**: Each access with its named user, even though the terminal is shared The same pattern solves retail, logistics and customer service. When there's no reader either, the USB token with split key between equipment and user covers the scenario. ## It connects to the directory you already have and the applications you already use. Additions, deletions, and role changes arrive from your directory without manual steps. It deploys on your servers, in the cloud, or both, and can protect devices where nothing is installed. | Identity source | Mechanism | What it solves | |---|---|---| | Active Directory on-premise | ADConnect | Secure and automatic integration of the local directory, with real-time synchronization | | Entra ID / Azure AD | SCIM | Immediate provisioning and deprovisioning from the cloud IdP | | Google Cloud Identity | SCIM / OIDC | Unified identity for organizations with Google stack | | Local users | CSV import | Spot onboarding, groups without directory and third parties | | Applications and services | OIDC, SAML, RADIUS, SDK | More than 5,000 enterprise applications, cloud services and productivity tools; also RDP and SSH | ## Designed for the person who manages it every day. **Multiple organizations at once**: Multiple Entra ID in the same organization and a partner console to manage customer companies with their licenses. **Role-based permissions**: Each administrator sees and changes only theirs, and the console can be limited to your network's IPs. **Logging and metrics**: Every authentication and every change, with usage metrics and event delivery to SIEM. **Reusable policies**: Device, safe zone, and password policies that combine by application and group. ## Basic, Enterprise, and Premium. Each plan includes the previous one. They are a starting point: any module can be enabled and configured for your organization. | Module | Basic | Enterprise | Premium | |---|---|---|---| | **Authentication** | | | | | Ironchip app passwordless, with location | Included | Included | Included | | SMS, email, and magic link | Included | Included | Included | | OTP codes | Included | Included | Included | | FIDO2 keys and passkeys | Included | Included | Included | | Account recovery | Included | Included | Included | | Facial recognition | Not included | Included | Included | | Directory password as a factor | Not included | Included | Included | | USB keys and RFID cards | Not included | Included | Included | | safe zones | Not included | Included | Included | | Access policies | Included | Included | Included | | **Integrations** | | | | | SSO with OIDC and SAML | Included | Included | Included | | Login on Windows, Linux, and macOS | Included | Included | Included | | Desktop and RFID authenticators | Not included | Included | Included | | RADIUS, LDAP, and ADFS | Not included | Included | Included | | API and HTTP MFA | Not included | Included | Included | | **Directory and operations** | | | | | Users, groups, and devices | Included | Included | Included | | Provisioning from Entra ID, SCIM, and AD Connect | Not included | Included | Included | | Multi-organization and partner console | Not included | Included | Included | | Roles, IP whitelist, and white-label | Included | Included | Included | | Logging and metrics | Included | Included | Included | | SIEM delivery | Not included | Included | Included | | **Detection and response (ITDR)** | | | | | Threat feed and identity fraud | Not included | Not included | Included | | Rules editor | Not included | Not included | Included | | Forensic investigation and cases | Not included | Not included | Included | | Behavior explained and recommended rules | Not included | Not included | Included | | **Other products** | | | | | Phishing Shield | Not included | Not included | Included | | Privileged access (PAM) | Not included | Not included | Included | Named user license: one person can have multiple aliases, devices, and applications without counting as an additional user. Premium includes dedicated 24/7 support. ## Frequently asked questions about the identity platform ### How do I add MFA to workstations without a corporate phone? With a method that does not depend on the phone: NFC or RFID card in a reader, USB token with split key between token and workstation, or Ironchip's desktop authenticator. All three can also require access from the workstation's safe zone. ### What happens if an employee's password or passkey is stolen? It does not work for the attacker. In addition to the credential, access requires the registered device and, if policy demands, the radio signature of the place matches a safe zone. A valid credential used from another place is blocked and generates an alert. ### Does Ironchip replace my identity provider? No. Ironchip connects to Active Directory, Entra ID, Google Cloud Identity or LDAP as a user source and protects applications via OIDC, SAML, RADIUS or its API. It can function as an IdP or add its verification to the one you already use. ### Is employee location recorded? Coordinates or movement history are not stored. A place's signature is anonymous, cannot be converted into an address, and is only compared at the moment of access. ### Does it help comply with ENS, NIS2 and DORA? Yes. Ironchip is in the CCN CPSTIC catalog at HIGH level, has LINCE certification and ENS certification in the high category, and logs who accesses, from where, and with what device, with the evidence required by audits. ## Start with a critical application and a group of users. Without replacing your current systems and with measurable results from the first week. [Request a pilot](https://www.ironchip.com/en/talk-sales?producto=Location-Based%20Authentication#hs-demo-form) [Technical documentation](https://docs.ironchip.com)