Enterprise Authentication &eIDAS signatures
Strong login and signing for large firms. It is built right into SecTepe.Core and meets EU rules in full.
What you get
- WebAuthn / FIDO2
- SAML 2.0 / OIDC SSO
- Multi-factor login (MFA)
- eIDAS signatures
- SCIM provisioning
- Audit logs
Features at a glance
Secure login, user provisioning and qualified signatures. All of it works out of the box.
FIDO2 Hardware Keys
Log in with a key that phishing can't trick. Use a YubiKey, a Nitrokey or any device that supports WebAuthn.
SAML 2.0 / OIDC SSO
Plug in the IdP you already use. That can be Azure AD, Entra ID, Okta, Keycloak and more.
Adaptive MFA
MFA kicks in based on risk. It looks at the context: where a user is, which device they use, how they behave, or what admin task they start.
eIDAS Signatures
Sign policies, approvals and audit records. You can use qualified or advanced e-signatures.
SCIM Provisioning
SCIM 2.0 creates, updates and turns off users and groups for you.
Session Management
Set fine-grained session rules and idle timeouts. You can force a logout, and each session leaves a full audit trail.
Your benefits
Passwords alone are not enough. Zero-trust login, keys bound to hardware and qualified signatures guard your compliance platform. They stop phishing and credential stuffing and cut insider risk.
- FIDO2 and WebAuthn hold up against phishing
- Single sign-on for all your staff
- Qualified signatures that meet the EU eIDAS rules
- SCIM handles joiners, movers and leavers for you
- Each login and signature lands in a log that shows any tampering
Use cases
Zero-trust rollout
Move each admin and power user to a login that phishing can't break.
Policy approvals
Sign policies and risk treatments with qualified signatures. They hold up in an audit.
Enterprise IdP integration
Keep the identity setup you have, such as Entra ID or Keycloak. Link it with SAML or OIDC.
Privileged access
Ask for one more MFA step before a sensitive admin task. Each step is logged in full.
How Enterprise Auth works in practice
SecTepe.Core handles sign-in, user sync and signatures inside the platform. Each of these settings belongs to one tenant. So the identity provider of one tenant never decides who gets into another tenant.
Sign-in methods
- Passwords with TOTP codes from an authenticator app. Each user gets ten backup codes, and each code works only once. Core blocks a TOTP code that was already used.
- Passkeys based on WebAuthn and FIDO2. Users add and remove their own keys. A login challenge is valid for five minutes.
- Single sign-on over SAML 2.0 or OIDC. There are presets for Azure AD, Okta and Google Workspace. Other IdPs connect through the generic SAML or OIDC option.
- API keys for service accounts, such as the MCP server. Core stores only a SHA-256 hash of each key. A key without a role has no rights.
Setting up SSO and user sync
Only a tenant admin can add an SSO configuration. A new one starts out disabled. You run a connection test first and switch it on when it works. Core gives you the SAML metadata for your IdP. The login page then shows the SSO button that fits the domain the user visits.
Core can create users on their first SSO login. Group claims map to roles in Core, and each rule has a priority. For Active Directory and Entra ID, Core can also sync users on a schedule. If you turn on deprovisioning, users who are gone from the directory are deactivated.
Policies and signatures
A tenant security policy can require MFA for all users or only for admins. It can also require a passkey for admins. New users get a grace period of 30 days by default. Core lists each user who does not meet the policy.
Signature requests run through a provider you choose. Core has an internal provider and connectors for D-Trust and DocuSign. For qualified signatures (QES), you connect a trust service provider such as D-Trust. Signers sign one after another or in parallel. Bulk signing and public signing links are also built in.
Common questions
Is every SSO login logged? Yes. Core writes each SAML and OIDC login to an SSO audit log. The entry shows success or failure, the provider and the user's email.
Where do the secrets live? Core encrypts TOTP secrets and the credentials of signature providers at field level. You can host Core yourself with Docker Compose or the Helm chart.
Ready for enterprise authentication?
Book a personal demo. We show you how SecTepe.Core guards identities and gives you qualified signatures.
How we work with you
We see every project as a long-term partnership, not a one-off delivery. Our approach has four clear phases. So you always know what happens next, who is in charge of what and which results to expect.
1. Free initial conversation
We learn about your starting point, your goals and your constraints. In 30 to 45 minutes we check whether our offer fits your situation. We outline possible paths and answer your questions, with no obligation.
2. Structured assessment
We record the current state: technical, organizational and regulatory. You get a prioritized assessment that names strengths, gaps and areas for action. It is the basis for a reliable offer.
3. Delivery with a dedicated lead
An experienced lead guides you through the delivery. You get clear milestones, transparent planning of effort and cost, and a weekly status. All results are documented and belong to you.
4. Continuous operations & review
After the project, we stay with you in operations. This includes managed services, regular reviews and tracking of open actions. We also reach out when new threats, new rules or technology changes come up.
Frequently asked questions about our services
These are the questions we hear most often in first conversations. For anything else, reach our team at hello@sectepe.de or by phone.
- How do we start working with SecTepe?
- Every project starts with a free initial conversation. You then get an offer with a clear scope, timeline and outcome. If you like, we start with a small pilot. That way you get to know how we work before the full project begins.
- What company sizes and sectors do you support?
- We work with small and mid-sized businesses, with corporate divisions and with operators of critical infrastructure (KRITIS). Our core sectors are manufacturing, trades, healthcare, financial services, energy and the public sector. Our focus is the mid-market in the DACH region.
- Do you work on site, remotely or hybrid?
- Both. Assessments, consulting and most managed services run remotely from our German data centers. For workshops, training and incident response on site, we mainly cover North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- We secure confidentiality by contract and by technology. Before every project we sign a mutual non-disclosure agreement. We process data only in German data centers. Access runs through zero-trust rules with multi-factor authentication. All staff are bound to confidentiality by contract and under the GDPR.