Cryptographic floor
under your IAM stack.

ScrambleID is the cryptographic verification layer underneath your IAM stack. Your IGA platform (SailPoint, Saviynt, Microsoft Entra ID Governance) keeps owning provisioning workflows, access certification, role mining, separation-of-duties enforcement. ScrambleID adds cryptographic proof per governance event: every provisioning action, every recertification decision, every role grant carries a signature. Recertification reviews then see cryptographic evidence of actual usage, not narrative reconstructed from session IDs. Audit becomes math.

No. CyberArk, BeyondTrust, Delinea, HashiCorp Vault: your PAM keeps owning credential vaulting, session recording, privileged session control.ScrambleID is additive, not replacement. What changes: JIT cryptographic provisioning replaces standing privilege as the default. Every privileged action within a session carries a per-action cryptographic signature. Service accounts get scoped, revocable, audited identity per agent. The PAM's existing session-control workflows continue; the substrate strengthens them.

They don't have to. The cryptographic ceremony embeds natively in your existing customer-facing mobile app via SDK. Your wordmark, your colors, your typography. They never download anything called "ScrambleID." Fallback path for users without your app: cryptographic verification through a browser flow. The "my customers won't install another app" objection is structural, not real. They already have yours.

At joiner: cryptographic key enrollment at hire. Access exists when the key is enrolled, scoped to role. At mover: old keys revoke instantly when role changes; new keys issue for the new role. At leaver: cryptographic identity revokes at termination. The revocation is one API call; every downstream app stops accepting the key in the same moment. No orphan accounts. No stale entitlements. No drift between IdP and downstream apps.

Every authentication event carries a cryptographic signature: which hardware-bound key signed, when, on which device, against which verifier. Audit becomes evidence, not narrative. The signatures are tamper-evident; a missing or modified record fails cryptographic verification. SIEM ingestion is supported (CEF, JSON streams). For governance-specific events (provisioning, role grants, attestations), the signatures attach at the IGA event boundary too. Your existing IGA logs gain cryptographic backing.

Recovery is designed in. The user enrolls a new device through a verified channel: in-person, cryptographic peer recovery (trusted contacts), or hardware-backed escrow. The lost device's keys revoke instantly across every system. No password to fall back to, so no fallback attack. Recovery uses the same cryptographic primitives as primary auth, not a weaker shadow path.

Cryptographic proof on every third-party interaction. Partner identities carry expiry plus revocation at the substrate layer. Offboarding the partner revokes their cryptographic identity in one API call. Every downstream system stops accepting their proof in the same moment.Partner trust stops depending on transitive IdP security. If the partner's IdP gets breached, the attacker still can't forge a cryptographic proof your substrate accepts.

ScrambleID is AAL3 aligned per NIST SP 800-63-4: hardware-bound multi-factor cryptographic authenticator with phishing resistance. Formal AAL3 certification applies to end-to-end systems and depends on your full configuration; the rail gives you the authenticator that clears the bar. On IAL: identity proofing (verifying the person is who they say they are at enrollment) stays with your IdP or proofing provider. ScrambleID adds cryptographic AAL on top of the IAL workflows you already run.

ScrambleID provides cryptographic evidence of every privileged access event to systems in SOX scope. SoD enforcement remains your IGA platform's responsibility (the policies, the role definitions, the conflict detection). What ScrambleID adds: cryptographic audit trail for every privileged action; the SoD-relevant evidence (who accessed what, when, with what authorization) is signed at the cryptographic substrate. Auditors get cryptographic proof, not log reconstruction. For SOX-relevant procurement reviews, SOC 2 Type II is the standard third-party evidence; full report in the procurement package.

Yes. Named customer references with reviewer permission, matched to industry segment and IAM use case, available on request. References are provided after a mutual NDA. Contact procurement@scrambleid.com.