Skip to content
Bastyx
Early Access
Early accessFor teams of 20–500

Access without credentials.Passwordless access for your laptops, servers and infrastructure.

Give every employee one secure identity. Provision access in minutes, authenticate with passkeys or security keys, and revoke everything from one place.

Join Early AccessSee How It Works
Concept of the Bastyx admin console showing employee Alex Morgan in Engineering: two enrolled laptops, a security key, fingerprint and passkey as authenticators, access to production SSH, GitHub, AWS and internal apps, and a low risk rating.

Concept UI with sample data. Bastyx is in early access; capabilities are labeled Planned until they ship.

Designed around open standards

No proprietary protocol to take on faith.

  • FIDO2

    Hardware-backed, phishing-resistant sign-in

  • WebAuthn

    The W3C standard browsers implement

  • Passkeys

    Synced or device-bound credentials

  • CTAP2

    How security keys talk to devices

  • OpenSSH

    The SSH client your team already uses

The problem

Access sprawls. Nobody sees all of it.

Credentials pile up across laptops, password managers, servers and cloud consoles. Security becomes a collection of disconnected systems, and offboarding becomes guesswork.

  1. 01

    An employee leaves.

    Which laptops, SSH keys, servers, cloud accounts and apps can they still reach? Most teams find out by searching.

  2. 02

    A contractor gets an SSH key.

    Who remembers to revoke it six months later? Static keys don’t expire, and they don’t say whose they are.

  3. 03

    Strong authentication turns into a ritual.

    Codes, prompts and VPN hops on every login. People find workarounds, and the workarounds become the risk.

Example access audit for Jordan Lee, three weeks after leaving: an SSH key still valid on 14 servers, an AWS access key, a GitHub token with no expiry, a shared password vault, an untracked laptop admin account and a revoked VPN certificate.

What a manual access audit typically turns up. Example scenario.

Offboarding Planned

Access should end when employment does.

Your developer left Friday. Their access ended Friday. One action removes laptop sign-in, server access, cloud roles, application sessions and registered security keys, and records every change.

Concept of offboarding Alex Morgan: laptop access, production SSH, cloud access, security key and internal apps each change from Active to Revoked, and an audit record is created.

Concept UI with sample data. The product is in development and details will change.

  • Every access path in one view

    Bastyx is designed to know what each person can reach, so offboarding isn’t a search through five consoles.

  • Nothing left to rotate

    No shared passwords or long-lived SSH keys means nothing behind them to chase after someone leaves.

  • Proof, not hope

    An audit record shows what was revoked, when, and by whom. Useful for you, and for your next security review.

Revoke once. Revoke everywhere.

Join Early AccessHow offboarding works

How it works

Enroll. Grant. Control.

Three steps from new hire to full audit trail. No keys to copy, no passwords to hand out.

  1. 01

    Enroll

    Add the employee. Enroll their device. Register a passkey, security key or fingerprint.

    Enrollment checklist: person added, laptop enrolled, security key registered, fingerprint optional.
  2. 02

    Grant

    Assign access to laptops, servers, apps and cloud roles by policy, or grant it for a fixed window.

    A policy granting the Engineering team access to prod servers with a security key, plus a two-hour temporary grant.
  3. 03

    Control

    Watch authentication events as they happen. Step up, approve or revoke access instantly.

    Live events showing an allowed SSH login, a pending approval and a blocked cloud login, with a Revoke all action.

Every request takes the same path.

The fingerprint reader isn’t the product, and neither is the security key. They’re authenticators. Bastyx is the control layer between people and what they access, and every decision ends in an audit event.

  1. EmployeeAlex Morgan
  2. IdentityOne identity, everywhere
  3. DeviceEnrolled and known
  4. AuthenticatorPasskey, key or fingerprint
  5. Bastyx policyAllow, step up or deny
  6. ResourceLaptop, SSH, cloud, app
  7. Audit eventWho, what, where, when

For engineering teams Planned

SSH without SSH-key chaos.

Long-lived keys copied to servers are the hardest credentials to track and the easiest to forget. Bastyx is designed to replace them with short-lived access tied to a person, a device and a policy.

Touch. Authenticate. Connect.

How Bastyx approaches SSH access
Terminal session: the user runs ssh production; Bastyx verifies the device, the identity, a security key touch and the eng-production policy, then connects to prod-api-03.

Illustrative flow. Planned SSH support using a standard OpenSSH client.

  • No authorized_keys to maintain

    Access comes from policy, not from public keys copied onto every server.

  • Expires by default

    Credentials are issued per session and expire on their own. Nothing to chase later.

  • Your client, your workflow

    Designed for the standard OpenSSH client and your existing config. Touch your key and connect.

  • Production access on request

    Ask for elevated access for a fixed window. It’s approved in the flow and ends automatically.

Devices and authenticators

One identity. Every machine.

Sign in to workstations, servers and internal apps with the same identity, verified by the authentication hardware your team already trusts.

Where you sign in

  • Windows workstation login

    Sign in to Windows with a passkey, key or fingerprint.

    Planned

  • Linux workstation login

    Passwordless desktop and sudo authentication.

    Planned

  • SSH and servers

    Short-lived, identity-bound server access.

    Planned

  • Internal applications

    Single sign-on for the tools your team runs.

    Planned

  • macOS login

    Under evaluation with early-access teams.

    Exploring

How you prove it’s you

Concept render of a compact USB-C security key with a fingerprint sensor

Concept: an optional USB-C fingerprint key. Bastyx doesn’t require proprietary hardware.

  • Passkeys

    Synced or device-bound. Phishing-resistant by design.

  • Device biometrics

    Built-in fingerprint and face sensors on laptops and phones.

  • FIDO2 security keys

    USB-A, USB-C and NFC keys from the vendors you already use.

  • USB-C fingerprint readerExploring

    For machines without a built-in sensor. Optional.

Biometrics stay on the device. With FIDO2, fingerprint matching happens on the authenticator. Bastyx is designed to receive only a signed result, never a fingerprint.

Concept of a risk evaluation for production server access by Alex Morgan: known device, new location Lisbon, unusual time 2:43 AM, sensitive production database. Risk is Elevated, and the matched rule requires additional security-key verification.

Concept UI with sample data. The product is in development and details will change.

Risk-based authentication

Signals inform. Your policy decides.

Bastyx watches authentication signals in real time. When something looks wrong, your policy can require stronger verification, request approval or block access.

Deterministic rules
Policies are explicit conditions you can read, test and review. The same inputs always produce the same decision.
Explainable decisions
Each event records the signals that fired, the resulting risk level and the rule that applied.
Proportionate responses
Allow, step up, require approval or deny. You choose the response per resource, so low-risk work stays fast.

PlannedAnomaly detection helps surface unusual patterns. It raises risk; it never acts on its own.

Admin console

Know who accessed what, from which device, and when.

People, devices, servers, apps and security keys in one place. Every authentication and every admin action lands in one searchable event log.

Concept of the Bastyx admin overview: 84 active employees, 131 managed devices, 212 protected resources, 3,418 authentication events and 7 blocked attempts in the last 24 hours, above a table of recent events listing employee, resource, device, authentication method, risk, result and time.

Concept UI with sample data. The product is in development and details will change.

Security principles

Security shouldn’t require blind trust.

We’d rather show our work than ask for faith. Here’s what Bastyx is built on, and where you can check it.

  • Open standards

    FIDO2, WebAuthn and passkeys. Standards reviewed in public, implemented by every major platform.

  • Hardware-backed authentication

    Security keys and device-bound passkeys keep private keys in hardware. Bastyx never sees them.

  • Auditable events

    Every authentication and admin action is designed to be recorded: who, what, which device, when, and which rule decided.

  • Granular access policies

    Scope access by person, team, device, resource and time. Grant temporarily. Require step-up where it matters.

  • Customer-controlled deployment

    Use Bastyx as a hosted service or, where it makes sense, run the control plane in your own environment.

  • Clear administrative controls

    Admins authenticate the same way everyone else does, and their actions leave the same audit trail.

Read the security overview

Deployment

Roll out in stages. No IAM team required.

Bastyx is designed for a gradual rollout: prove it on one team and one server group, then widen it by policy.

  1. 1

    Start with one team

    Enroll a pilot group and their devices. Nobody else changes anything.

  2. 2

    Protect one server group

    Put a set of servers behind Bastyx while existing access keeps working.

  3. 3

    Keep your identity provider

    Bastyx is designed to work alongside your IdP, not replace it.

  4. 4

    Expand by policy

    Add teams, devices and resources as your policies prove out.

Bastyx Cloud

Planned

Hosted by us. The fastest way to start, with nothing to operate.

Customer-hosted

Planned

Run the control plane in your own environment when policy or regulation requires it.

What it will cost

Per active user, per month. Prices published before general availability. Hardware is optional and separate.

See the pricing model

FAQ

Questions buyers ask first.

Anything we haven’t built yet is described as planned. If your question isn’t here, talk to an engineer.

What is Bastyx?

Bastyx is a passwordless access platform for technical teams. It's designed to give each employee one identity that works across their laptop, the servers they SSH into, cloud consoles and internal apps. People authenticate with passkeys, security keys or biometrics, and access is governed by policies you control. Bastyx is in early access today.

Does Bastyx replace passwords?

For the access Bastyx manages, yes. People prove who they are with a passkey, a FIDO2 security key or device biometrics instead of a password. Systems outside Bastyx's scope may still use passwords; the goal is to remove them everywhere Bastyx controls access.

Can Bastyx protect SSH access?

SSH is central to the design. Instead of long-lived keys copied into authorized_keys files, Bastyx is designed to issue short-lived credentials tied to a person, an enrolled device and a policy, using the standard OpenSSH client. SSH support is planned, and early-access teams will help shape it.

Does it work with physical security keys?

That's the intent. Bastyx is built around FIDO2 and WebAuthn, so it's designed to work with standards-based security keys over USB-A, USB-C and NFC. You shouldn't need proprietary hardware, and keys your team already owns should keep working.

Does it support biometric authentication?

Yes, through hardware you already have: built-in fingerprint and face sensors on laptops and phones, and FIDO2 security keys with fingerprint readers. We're also exploring an optional USB-C fingerprint reader for machines without a sensor. Biometrics are always one method among several, never a requirement.

What happens if an employee loses their security key?

An admin revokes the lost key in one step so it can no longer be used. The employee keeps working with another registered authenticator, such as a passkey on their laptop, and registers a replacement. We'll recommend at least two authenticators per person, and the planned recovery flow requires admin approval so a lost key can never be used to recover itself.

What happens when an employee leaves?

You offboard them once in Bastyx. That single action is designed to revoke device sign-in, SSH access, cloud and application access, and their registered authenticators together, then record exactly what was removed, by whom and when.

Can Bastyx run in our environment?

A customer-hosted option is planned for teams that need the control plane inside their own environment. Before it's available we'll publish the architecture, the infrastructure requirements and exactly what, if anything, connects back to us.

Does Bastyx replace our identity provider?

No. Bastyx is designed to work alongside your identity provider for directory and single sign-on, and to extend passwordless authentication to places identity providers usually don't reach: workstation login, SSH and server access. We also plan to let smaller teams without an identity provider manage people directly in Bastyx.

How is Bastyx different from a password manager?

A password manager stores secrets so people can paste them. Bastyx is designed to remove the secrets. Access is proven with cryptographic authenticators, granted by policy and revoked centrally, so there is nothing for people to store, share or forget to rotate.

Does Bastyx store fingerprints?

No. With FIDO2 and WebAuthn, fingerprint matching happens on the device or security key. Bastyx is designed to receive only a cryptographic signature showing that verification happened, never fingerprint images or templates.

What will Bastyx cost?

Bastyx will be priced per active user per month, with a separate option for customer-hosted deployments. We'll publish prices before general availability. Security keys and optional hardware are separate, and you can use keys you already own.

Early access

No passwords. No SSH keys to chase. No access left behind.

Tell us what you’re securing. We’ll follow up if Bastyx is a fit for your team today.

  • Built for teams of 20–500 people running real infrastructure
  • Early-access teams shape SSH, device login and offboarding first
  • A short form. No phone number, no sales sequence
What are you trying to secure? Optional

No phone number. We use this only to contact you about Bastyx. Privacy