Identity for
what runs the world.
Device-bound, identity-derived keys for the grid, the network, and the fleet, so every controller, sensor, and automated process proves who it is on every connection, and keeps proving it after quantum computers arrive.
What OT security teams are up against
Converged networks, fleets that dwarf the workforce, and equipment that will outlive the cryptography it shipped with.
Operational technology was never built to authenticate
Decades-old controllers, flat networks, and shared passwords are now reachable from IT. Regulators in North America, Europe, and Canada are converting “should” into “must” for critical-infrastructure cyber controls.
Devices outnumber people, and certificates do not scale
Fleet-wide PKI means issuing, rotating, and revoking certificates for every meter, radio, and gateway; a leaked device certificate is a skeleton key.
Long-lived assets meet a short cryptographic runway
A substation controller or a vehicle ECU installed today is still in service decades from now; the RSA and elliptic-curve keys it ships with will not be.
What goes live
The modules you can turn on in the current product, without a platform migration first.
Zero-Trust Keys for devices
Key pairs derived from device identity at the point of use; no stored private key to extract; conventional and post-quantum keys from one identity primitive.
Agent and process identity
Verifiable identity for automation, control software, and AI-driven operations with a human-anchored accountability chain; zero-knowledge proof of the responsible human; delegation as verifiable credentials.
Operator identity
Identity verification and passwordless authentication for technicians and remote operators; FIDO/WebAuthn with liveness-backed enrollment.
Verifiable Credentials
Device provenance, maintenance authorization, and role credentials that revoke; built on W3C Verifiable Credentials.
SDK and integration
Embed signing and mutual authentication in gateways, SCADA front ends, and fleet software; TypeScript SDK, REST and GraphQL, webhooks.
The same deployment, on the trust layer
Mutual authentication without a certificate authority
Devices and services verify each other's identity-derived signatures directly, including across vendor and operator boundaries.
An unforgeable chain from action to accountable human
Every automated command, firmware update, and configuration change signs with a key that traces to an authorized person without exposing them.
Post-quantum protection for assets that outlive the threat timeline
Keys issued today under the NIST post-quantum standards remain valid; no forced re-keying of fielded equipment.
A path into hardware
Post-quantum HSM chips and ECU-integrated secure enclaves are in development for vehicles and edge devices.
Where teams start
Each one runs on the modules above — pick the one that matches the quarter you are in.
- Device onboarding and attestation for smart-grid, water, and transport telemetry
- Secure firmware and configuration signing with human-anchored approval
- Telecom subscriber, SIM, and network-function identity for mobile cores and private networks
- Connected-vehicle and fleet identity with ECU-level roadmap
- Remote operator access to OT systems with revocable, verifiable credentials
What we build on, and what we claim
Open specifications, named without the version churn. Every status below is a different promise.
NIST post-quantum standards
W3C Verifiable Credentials and DIDs
FIDO/WebAuthn
OpenID Connect
Canadian-owned; headquartered in British Columbia.
Identity forwhat runs the world.
Start with one fleet or one site. Give every device and process an identity it cannot lose, then extend it across the network. Request a technical briefing.