Sign in with a fingerprint, face scan, or security key, with no password step. A passkey stays bound to your device, so there is nothing to phish or reuse, and you can register, rename, and revoke several of them.
Security
Control who gets in, and what they can do once they are.
Passkey and two-factor sign-in, revocable sessions, least-privilege roles, and guided key management, running inside your own deployment.
Account and sign-in security
Make a stolen password worth nothing.
Sign in with a passkey instead of a password, and add a second factor when you need one.
Turn on a one-time code, sent to your email each time you sign in with a password, so a leaked or guessed password on its own is not enough to get in.
Passwords must be at least 12 characters and can be changed any time from your account page. Sign-in attempts are rate limited, and failures return generic errors so they never reveal which accounts exist.
Session management
Know every session, and end any of them.
Sign-in is only the start. OneView keeps sessions visible and revocable, so access ends when it should.
- 01
See every active session
Review each signed-in browser with its client, network source, last activity, and expiry, and spot the one you do not recognize.
- 02
End access immediately
Revoke a single session, or sign out everywhere, and the access ends right away instead of waiting for a timeout.
- 03
Administrators can act for the team
With the right permission, an administrator can review and revoke any user's sessions, or every session at once, and export the list for their records.
- 04
Access changes take effect straight away
Disable a person or change their role, and their existing sessions are cut off immediately, so stale access does not linger.
Role-based access control
Give every person the access their job needs, and no more.
Define exactly what each person and each integration can do, and let the server enforce it.
- 01
Build roles from the ground up
Create roles from a catalogue of specific permissions and give each one only the access it needs. The only built-in role is the system administrator role, so every other role reflects how your institution actually works.
- 02
Separate seeing from doing
Viewing a verification's history, reading its full result, executing a check, and exporting are separate permissions. Being able to run a check does not mean being able to read what comes back.
- 03
Enforced where it counts
Permissions are checked by the server on every protected operation, and hiding a menu item is never the only protection. Administrators cannot change their own role or disable their own account.
Key management
Take complete control of your cryptographic infrastructure.
Modern security demands that you aren't locked into a single encryption model. Manage how your provider secrets are protected with flexible, enterprise-grade key storage options.
Multi-provider KMS integration
Secure your sensitive data with industry-standard services, including HashiCorp Vault Transit, AWS KMS, Google Cloud KMS, and Azure Key Vault.
Zero-memory exposure architecture
When you use an external KMS or vault, the long-lived key stays inside that service, isolated from application memory.
Zero-touch browser safety
Configure and generate step-by-step migration instructions through the UI, entering only non-secret identifiers, so no raw tokens or secrets ever touch the browser or the application layer. You run the commands yourself, on the server or at your provider.
Start a conversation
Request a demoSee how OneView keeps access under your control.
Walk through sign-in options, session controls, roles, and key management with our team.