Identity infrastructure
HSID is a private identity provider — passkeys, two-factor authentication, and session control handled in one place, so sign-in is built once, correctly, instead of rebuilt insecurely by every application that needs it.
How it works
The same sequence for every sign-in, regardless of which application asked for it.
01
An account is looked up first, before any credential is asked for — only the methods that account actually has get offered, never a dead-end option.
02
A passkey, a password, or a one-time code — whichever the account has set up. Accounts with two-factor authentication enabled are asked for it automatically.
03
One verified session, recognized wherever it's needed next, until it's revoked or it naturally expires.
Security model
No plaintext secrets, no shared passwords across systems, nothing to phish that would actually work.
Sign in with a fingerprint, face, or security key, bound to the device that holds it. Nothing is transmitted that could be stolen and reused elsewhere.
Standard authenticator-app codes, with one-time recovery codes issued at enrollment so losing a device never means losing the account.
A session that's been open a while is asked to prove itself again before anything sensitive happens — changing a credential, touching another account.
Every active session is visible, with the device and rough location it was opened from, and can be revoked individually or all at once.
Every credential change and administrative action leaves a record, including our own — so nothing about your account can be altered without a trace.
TLS in transit, hashed and salted credentials at rest. No password or session token is ever stored as plain text.