Ydenticator · MFA + PoT

Multi-Factor Authentication with hardened Proof of Transactions

Proves who you are — and what you approved. A private knowledge profile, device-bound keys and signed receipts bind them together.

Three factors, one code — and one signed approval

Something you know

A 30-question yes/no profile created at registration. One random question is checked server-side before a code is released.

Something you are

Face ID, Touch ID or Windows Hello can unlock the device key through WebAuthn PRF on compatible devices.

Something you own

Your enrolled device holds the keys used to unlock your encrypted profile and sign transaction approvals.

From onboarding to signed approval

01
Create your key
Answer 30 yes/no questions and encrypt your profile.
02
Add providers
Scan a provider’s RFC 6238 MFA QR code.
03
Request a code
Answer one random question; the server checks it before releasing the code.
04
Recover or enroll
Use a single-use recovery code or securely pair another device.
05
Approve a transaction
Read the exact details, answer your question and sign on your device.

Prove what you approved, not just who you are

Exact details shown

Review what, to whom, how much and when it expires. Any content change alters the digest, breaking the original proof.

Question + device

A transaction-bound challenge precedes an ECDSA P-256 device signature. Only the public approval key is stored, locked once set.

Single-use approval

Challenge and request are claimed atomically before signing, refusing replays and concurrent approvals. Requests expire after five minutes.

Signed receipt

A reference such as YD-XXXX-XXXX identifies the server-signed proof. Public verification shows state, digest and timing — never transaction details.

Security hardening

Production protections live in versioned migrations and application code, with automated regression checks on GitHub.

Device approval keys locked against overwrite.
Single-use claims prevent double transaction approval.
Public verification omits transaction details.
Browser write access to profiles revoked.
Challenge records unreadable from the browser.
Anti-abuse blocks table codified with restricted access.
Code requests reduced from four attempts to two.
Admin role granted by user ID, never by email.
Revoked devices cannot be re-enabled from the browser.
Human check verified server-side with Cloudflare Turnstile.
Abuse strikes bound to email, hashed origin and browser.
One new key per quarter; more need admin approval.
Offline onboarding: encrypted answers, single-use 24-hour ticket.
Sessions last five minutes; sign-out is never silent.
Onboarding rejects incomplete or duplicated answer sets.
Automated security regression tests and dependency fixes on GitHub.

Recovery and encrypted enrollment

Each code protects the profile with PBKDF2-HMAC-SHA256 (600k iterations) and AES-GCM-256. Recovery is rate-limited; enrollment links are signed, expiring, single-use.

Device-bound keys

AES-GCM-256 protects your profile. WebAuthn PRF on compatible devices, a non-extractable browser key otherwise. Keys transfer encrypted during pairing.

MFA Multidevice

Scan an RFC 6238 QR code. Variable digits, periods, SHA-1/256/512, ±1-step window, replay checks, redacted logs.

EU identity leaders and Ydenticator

Confirmed capabilities are separated from items to verify. EU origin alone does not prove sovereign hosting; hardware may be portfolio-wide.

EU identity leaders and Ydenticator
Capability	Ydenticator	Thales OneWelcome	Evidian / Eviden	TrustBuilder
EU sovereign hosting	Roadmap — to verify	EU vendor; sovereign region to verify	On-prem / EU cloud — to verify	EU SaaS — to verify
Portable hardware token	Platform keys (Secure Enclave, TPM); portable token support to verify	Thales SafeNet tokens — integration to verify	Smart card, RFID, OTP	FIDO tokens
Zero-knowledge server	Encrypted profile; expected answers checked server-side	Not advertised in this comparison	Not advertised in this comparison	Not advertised in this comparison
Transaction signing (PoT)	Question + device signature	To verify	To verify	TB Transaction Signing
Knowledge factor beyond PIN	30-question private profile	Password / PIN	Password / PIN	PIN
Deployment	Installable PWA; no dedicated hardware shipped	CIAM platform (SaaS)	Enterprise IAM suite	MFA / CIAM SaaS

Ydenticator

EU sovereign hosting: Roadmap — to verify
Portable hardware token: Platform keys (Secure Enclave, TPM); portable token support to verify
Zero-knowledge server: Encrypted profile; expected answers checked server-side
Transaction signing (PoT): Question + device signature
Knowledge factor beyond PIN: 30-question private profile
Deployment: Installable PWA; no dedicated hardware shipped

Thales OneWelcome

EU sovereign hosting: EU vendor; sovereign region to verify
Portable hardware token: Thales SafeNet tokens — integration to verify
Zero-knowledge server: Not advertised in this comparison
Transaction signing (PoT): To verify
Knowledge factor beyond PIN: Password / PIN
Deployment: CIAM platform (SaaS)

Evidian / Eviden

EU sovereign hosting: On-prem / EU cloud — to verify
Portable hardware token: Smart card, RFID, OTP
Zero-knowledge server: Not advertised in this comparison
Transaction signing (PoT): To verify
Knowledge factor beyond PIN: Password / PIN
Deployment: Enterprise IAM suite

TrustBuilder

EU sovereign hosting: EU SaaS — to verify
Portable hardware token: FIDO tokens
Zero-knowledge server: Not advertised in this comparison
Transaction signing (PoT): TB Transaction Signing
Knowledge factor beyond PIN: PIN
Deployment: MFA / CIAM SaaS

Ydenticator combines a private knowledge profile, device-bound encryption and device-signed transaction proofs without dedicated hardware to ship.

By the numbers

3: authentication factors
30: yes/no profile questions
256: bit AES-GCM encryption
120: bits per recovery code

Get a code / Sign up