Enterprise Authentication &eIDAS signatures
Strong login and digital signatures for larger firms. Both are built right into SecTepe.Core and follow EU rules.
What you get
- Hardware keys (FIDO2)
- Single sign-on (SSO)
- Multi-factor login (MFA)
- eIDAS signatures
- Automatic user management
- Audit logs
Features at a glance
Secure login, user provisioning and qualified signatures. All of it works out of the box.
Hardware keys
Log in with a key that phishing can't trick. Use a YubiKey, a Nitrokey or any device that supports the FIDO2 standard.
Single sign-on (SSO)
Staff log in with their company account. Plug in the identity provider you already use via SAML 2.0 or OIDC. That can be Azure AD, Entra ID, Okta and more.
Adaptive MFA
Extra login steps kick in based on risk. Core looks at the context: where a user is, which device they use, how they behave or which admin task they start.
eIDAS signatures
Sign policies, approvals and audit records. You can use qualified or advanced e-signatures.
Automatic user management
The SCIM 2.0 standard creates, updates and turns off users and groups for you.
Session control
Set fine-grained session rules and idle timeouts. You can force a logout, and each session leaves a full audit trail.
Your benefits
Passwords alone are not enough. Zero trust means every access is checked. Hardware keys and qualified signatures guard your compliance platform. They stop phishing and logins with leaked passwords, and cut insider risk.
- FIDO2 and WebAuthn hold up against phishing
- Single sign-on for all your staff
- Qualified signatures that meet the EU eIDAS rules
- New hires, role changes and leavers are handled for you
- Each login and signature lands in a log that shows any tampering
Use cases
Zero-trust rollout
Move each admin and power user to a login that phishing can't break.
Policy approvals
Sign policies and risk treatments with qualified signatures. They hold up in an audit.
Connect your identity provider
Keep the identity setup you have, such as Entra ID or Okta. Link it with SAML or OIDC.
Privileged access
Ask for one more login step before a sensitive admin task. Each step is logged in full.
How Enterprise Auth works in practice
SecTepe.Core handles sign-in, user sync and signatures inside the platform. Each of these settings belongs to one tenant. So the identity provider of one tenant never decides who gets into another tenant.
Sign-in methods
- Passwords with one-time codes (TOTP) from an authenticator app. Each user gets ten backup codes, and each code works only once. Core blocks a TOTP code that was already used.
- Passkeys based on WebAuthn and FIDO2. Users add and remove their own keys. A login challenge is valid for five minutes.
- Single sign-on over SAML 2.0 or OIDC. There are presets for Azure AD, Okta and Google Workspace. Other identity providers connect through the generic SAML or OIDC option.
- API keys for service accounts, such as AI agents. Core stores only a one-way fingerprint (SHA-256 hash) of each key. A key without a role has no rights.
Setting up SSO and user sync
Only a tenant admin can add an SSO configuration. A new one starts out disabled. You run a connection test first and switch it on when it works. Core gives you the SAML metadata for your identity provider. The login page then shows the SSO button that fits the domain the user visits.
Core can create users on their first SSO login. Group claims map to roles in Core, and each rule has a priority. For Active Directory and Entra ID, Core can also sync users on a schedule. If you turn on deprovisioning, users who are gone from the directory are deactivated.
Policies and signatures
A tenant security policy can require MFA for all users or only for admins. It can also require a passkey for admins. New users get a grace period of 30 days by default. Core lists each user who does not meet the policy.
Signature requests run through a provider you choose. Core has an internal provider and connectors for D-Trust and DocuSign. For qualified signatures (QES), you connect a trust service provider such as D-Trust. Signers sign one after another or in parallel. Bulk signing and public signing links are also built in.
Common questions
Is every SSO login logged? Yes. Core writes each SAML and OIDC login to an SSO audit log. The entry shows success or failure, the provider and the user's email.
Where do the secrets live? Core encrypts one-time-code secrets and the credentials of signature providers field by field. You can host Core yourself, in containers or on Kubernetes.
Ready for enterprise authentication?
Book a personal demo. We show you how SecTepe.Core guards identities and gives you qualified signatures.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.
Common questions
We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.
- How do we start working with SecTepe?
- Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
- What company sizes and sectors do you support?
- We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
- Do you work on site, remotely or hybrid?
- Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.