On-Demand Demos and Free Trials

Entrust Biometric Passkey combines phishing-resistant passkeys with verified identity to protect against account takeover attacks across enrollment, authentication, and account recovery journeys.

Enrollment begins with a standard username and password sign-in. The customer is then prompted to enroll a phishing-resistant passkey for future passwordless authentication. Before the passkey is created, identity verification is performed by scanning a government-issued ID document. A biometric check using liveness detection confirms the customer is a real person and guards against presentation attacks and deepfakes. The passkey is then bound to the verified identity and stored on the customer's device. The binding links the passkey to a verified individual rather than just the device.

For everyday authentication, returning customers tap to initiate sign-in using the stored passkey. Face ID or device biometrics authenticate the customer, with no password, SMS code, or OTP required. The process completes in seconds.

When a transaction exceeds a defined risk threshold, a step-up authentication request is triggered. The customer completes a biometric verification, and a live biometric is compared in real time against the identity enrolled at registration. If the match is confirmed, the transaction is authorized. This step-up flow reuses the trusted identity from enrollment without requiring passwords, one-time codes, or knowledge-based questions.

For account recovery on a new or replacement device, the original device-bound passkey is no longer available. The customer identifies their account and completes a biometric verification to confirm they are the same individual who originally enrolled. Once identity is confirmed, a new passkey is created and bound to the account, restoring passwordless access without help desk intervention or password resets.

The identity established at enrollment is reused across everyday login, high-risk transaction approval, and account recovery.

Entrust Workflow Studio supports orchestration of identity verification, fraud checks, and qualified electronic signatures in a single workflow. The platform offers no-code, drag-and-drop editing and built-in workflow templates, including compliance packages.

The ETSI Compliant IDV with QES for France workflow is a pre-built template compliant with Article R561-5-2 of the French Code monétaire et financier and ETSI 119 461. The workflow is viewable and configurable in a single interface.

Workflows contain three task types: Capture Tasks define what end users see and what actions they must take, such as capturing ID documents, faces, or biometric motions; Processing tasks run automated checks in the background; Decision Logic determines how the workflow proceeds based on results.

Certain tasks are locked and cannot be deleted, ensuring mandatory compliance steps remain in place. Customer-facing capture steps include identity document capture, face capture, and document signature.

In the qualified electronic signature capture step, the user reviews and signs a document, establishing a trusted link between the verified identity and the electronic signature. The document signed is typically a standard document such as terms and conditions.

Automated processing reports include a Document Report that analyzes the captured identity document video to detect fraud, prevent injection attacks, and verify document authenticity. A Face and Liveness Validation report detects deepfakes, injection attacks, and spoofing attempts. An optional Known Faces Report flags repeat face usage across onboarding attempts. A Device Intelligence Report checks that the same device was used to capture both the document and the face, to prevent injection attacks.

Automated decisioning routes compliant applicants to QES and directs exceptions for manual review.

QES provides the highest level of signature assurance under eIDAS, combining document authentication and identity verification. Document authentication creates legal evidence and reduces signing risk. Identity verification supports AML and KYC requirements for digital onboarding.