A stolen password lets the wrong person in.
Authentication and approval of critical actions
Every approval bound to the exact action. With signed proof.
AuthGuard binds each approval to the exact action shown on screen. The user confirms it with a passkey. The authorisation can be used once, and the decision is recorded in a signed receipt. It runs in the European Union, as a service or as a dedicated deployment, with post-quantum protection for connections and receipts.
- This action
- This person
- Single use
- Signed receipt
- Phishing resistant
ProofFlow · request
illustrative example
- Action
- Approve payment
- Amount
- €42,500.00
- Destination
- PT50 •••• •••• 4417
- Requested by
- Ana Ribeiro · Treasury
- SHA-256 digest
- 9f3c 51a0 … 7be2 e21a
ProofFlow Match
050 198
the same code in your browser and on your phone
- Awaiting approval
- Passkey verified
- Authorised · single use
- Consumed · signed receipt
Product overview
The product in four minutes.
This four-minute overview is narrated in Portuguese.
The problem
A rushed approval can authorise the wrong action.
A code or push notification can confirm someone responded without proving which action they approved.
ProofFlow · our technology
Proof bound to the exact request.
ProofFlow is AuthGuard’s authentication and approval engine. A signature for a different request cannot complete this one. Requests are denied unless an access policy explicitly allows them.
-
01 · Server
Define the request
The server creates a canonical intent containing the action, resource, requester, expiry and policy version. A SHA-256 digest covers the entire request.
-
02 · ProofFlow Match
Compare the codes
A six-digit code is derived from the digest and recalculated in the browser and on the phone. If the request is replaced, the codes no longer match.
-
03 · Passkey
Sign what you see
The user confirms with a passkey (FIDO2 / WebAuthn), using local verification. The signature is bound to that specific digest.
-
04 · Authorisation
Use once, keep the receipt
The authorisation expires after 2 minutes and can be consumed only once. The policy is evaluated again at consumption, and the decision is recorded in a signed, verifiable receipt.
One engine for
- Confirmation of every administrative change
- Application sign-in through OpenID Connect
- Approval of actions requested by other systems
- Approvals in the Sovereign tier
Platform
One platform, one proof.
IAM, MFA, PAM and RBA with AI on one platform, with ProofFlow binding every approval to the exact operation. AI agents and external access are in development.
IAM
People and groups, SCIM, single sign-on, a deny-by-default policy, audit and GDPR.
Explore: IAMMFA
With ProofFlow, people approve the exact operation, not just a sign-in: a passkey or the phone with a comparison code, and a signed receipt. Plus TOTP and HOTP, Windows, VPN and Wi-Fi.
Explore: MFAPAM
Just-in-time access, vault and rotation, SSH, RDP, PostgreSQL, application secrets, break-glass and dual control.
Explore: PAMRBA with AI
Every sign-in and approval assessed with signals, a GBDT model and an AI layer, with a graded, explained response.
Explore: RBA with AIAI agents & external access
External people and AI agents with a sponsor, an end date and a person approving every critical action an agent takes.
Explore: AI agents & external accessSolutions
Start where the risk is.
Six starting points sharing one core: access policy, audit and signed receipts. See all solutions.
Phishing-resistant passkeys
A passkey only answers the genuine address, and biometrics never leave the device.
See the solution: PasskeysCritical-action approval
People see the values, confirm with a passkey or on their phone, and a signed receipt remains.
See the solution: Critical actionsSingle sign-on: OIDC, SAML and Microsoft 365
One confirmation opens the right applications, with a policy rule for each one.
See the solution: Single sign-onTime-limited privileged access
Credentials in a vault, access requested and approved, SSH sessions recorded and sealed.
See the solution: Privileged accessWindows sign-in
After the password, a number on screen and an approval on the phone.
See the solution: WindowsVPN and Wi-Fi over RADIUS
The password, then an authenticator code or an approval on the phone.
See the solution: VPN and Wi-FiCompared with common methods
Beyond a second factor.
| Criterion | SMS code | TOTP code (app) | Approve / deny push | Number-matching push | Passkey (FIDO2 / WebAuthn) | ProofFlow |
|---|---|---|---|---|---|---|
| Resists phishing and real-time relay attacks | ✗ | ✗ | ✗ | partial | ✓ | ✓ |
| Shows the exact action and binds the approval to it | partial | ✗ | partial | partial | ✗ | ✓ |
| Single-use authorisation for that action | partial | ✗ | ✗ | ✗ | ✗ | ✓ |
| Signed, verifiable evidence for each decision | ✗ | ✗ | ✗ | ✗ | partial | ✓ |
| Post-quantum option | ✗ | ✗ | ✗ | ✗ | ✗ | ✓Sovereign |
Typical behaviour for each method varies by implementation. ProofFlow uses the Standard profile with a passkey, with a post-quantum option in the Sovereign tier.
Capabilities
Approval backed by verifiable evidence.
Choose the right method
- Passkeys (WebAuthn / FIDO2)
- TOTP, HOTP and OCRA codes
- Recovery codes and email recovery
- Phone approval on Android with a comparison code
Connect your existing systems
- OpenID Connect for application integration: RS256/ES256, confidential clients, PKCE, refresh and logout
- External authentication method for Microsoft Entra (in validation)
- Intents API: a system requests approval, a person approves, and a signed receipt and signed webhook are returned
- SAML 2.0, Microsoft 365 federation, RADIUS for VPN and Wi-Fi, and directories (Entra ID, Active Directory)
Control every change
- Console in Portuguese and English
- Each change requires recent passkey verification
- Access policies evaluated at issuance and consumption, with deny-by-default rules
- Helpdesk factor resets require dual approval
Keep a verifiable record
- Append-only audit log with SHA-512 chaining
- Decision receipts signed with ML-DSA-65 (plus Ed25519 in hybrid mode), verifiable offline
- Audit exports and per-person GDPR exports
- OpenTelemetry metrics and more than 30 alerts with runbooks
Built for Europe
- TLS 1.3 with hybrid post-quantum key exchange (X25519MLKEM768)
- Sovereign tier: ML-DSA-65 certificates and a dedicated approval device
- GDPR by design: remove personal data while retaining the proof
- Signed release pipeline with SBOM and provenance
Two ways to deliver, always in the EU
- AuthGuard SaaS: a shared platform, with each organisation's data and keys kept isolated
- Sovereign: a dedicated deployment per customer, operated by us or by the customer
- Data in the European Union (Ireland, with recovery in Frankfurt)
- Partners and distributors under their own brand (white label)
Pilots and partnerships
Start a pilot. Become a partner.
For organisations
Start with a critical action, such as a payment, an access change or an administrative task. We connect AuthGuard to your applications through OpenID Connect or the intents API, on AuthGuard SaaS or in a dedicated EU deployment.
For integrators and partners
Bring ProofFlow to your customers through integration, resale or managed services. Contact us to discuss the model that fits your business.