Control plane
Hosted in Türkiye. OIDC/OAuth2 endpoints, session and tenant management, organizations and roles, risk and MFA, federation, audit log.
Hybrid authentication platform
The login layer is yours. So are the keys.
EnclaveID integrates as easily as other hosted identity services, but its data stays in Türkiye and your token signing key never leaves your network.
For banks, insurers, fintechs and public institutions.
The problem
Fast services hold your keys. Building it yourself takes months.
Hosted identity services integrate quickly, but signing keys and user data live in someone else's cloud. Building your own takes months and leaves all of the security burden with you. In regulated sectors, neither is acceptable.
Approach
SaaS convenience, institutional control.
Crypto Proxy
A small container in your network. It signs tokens and holds the secret keys. You open no inbound ports.
Standard protocol
Your applications use OIDC and verify tokens with JWKS. Nothing proprietary to learn.
Flow
Four steps to the first token.
1
Install
Run the proxy as a container in your own network.
2
Tunnel
The proxy opens a persistent mutual-TLS (mTLS) tunnel. Your institution opens no inbound port.
3
Sign
When a user signs in, the full token content reaches the proxy. It applies your policy (tenant, lifetime, scope), signs, and writes its own log.
4
Verify
Your application verifies the token with standard JWKS.
Deployment
Deployment models.
| Model | Control plane | Proxy and keys | Status |
|---|---|---|---|
| Hybrid | EnclaveID (Türkiye) | In your network | In development |
| Fully on-premises | In your infrastructure | In your infrastructure | On the roadmap |
| Air-gapped | In your infrastructure, via Helm | In your infrastructure | On the roadmap |
Developers
Standard OIDC.
Give your library the discovery URL and it works. PKCE is mandatory. TypeScript SDKs and the admin console are in development.
Design principles
Simple, auditable, standard.
Short-lived keys
The signing key is generated in memory, never written to disk, and rotated regularly. A new public key is published before it is used.
Every signature recorded
The proxy logs every token it signs. The full token content, not just a digest, is checked against your policy.
Your vault
Tenant data-encryption keys are wrapped by a key in your own HSM/KMS/Vault.
Standard cryptography
We do not write our own cryptography: Ed25519/ECDSA P-256, AES-GCM, Argon2id.
Opaque sessions
Refresh tokens and session cookies are not JWTs and can be revoked instantly. Access tokens are short-lived.
If the link drops
New signing stops; issued access tokens keep working until they expire. Sessions are not dropped all at once.
Protocol
Safe defaults.
- PKCE required, no implicit flow.
- Access tokens last 5–15 minutes.
- Secrets are never logged or embedded in code.
- Every security-critical path has tests.
Consent
Every consent is its own step.
Membership
The approval required to create an account.
Commercial messages
Optional, independent of membership and revocable.
Data processing
Presented as a separate approval, never combined with the others in one box.
Note
Design goal.
The product is designed around the requirements of KVKK, Türkiye's data protection law. Compliance is addressed together with your institution's own legal assessment.
We are looking for design partners.
We are talking to institutions that want to work with us early, together with their security and architecture teams. Contact details will be published here soon.