Your data stays with your organisation.

IDentify Authenticator confirms that it's really you when you sign in to your organisation's applications. It is built so that IDentify itself sees as little as possible: no advertising, no analytics, no tracking.

Last updated 22 October 2026

Who is responsible

You use IDentify Authenticator because an organisation (usually your employer or your bank) runs IDentify for its sign-in. That organisation decides who may sign in, runs the sign-in server and keeps its sign-in records. Questions about your account there, such as which records it keeps or how to correct them, go to that organisation.

IDentify, a product of Systems Solutions for Information Technology ("we"), makes the app, runs the notification relay described below and this website, and is responsible for those parts.

What the app keeps and sends

On your phone

• For each account: the organisation's name and server address, your username and the name you gave this phone.
• Keys that prove it's your phone. They are made inside the phone's secure hardware (Secure Enclave on iPhone, Keystore on Android) and cannot be copied out of it. The key that approves sign-ins only works after Face ID, your fingerprint or your passcode.
• The secret behind your offline 6-digit codes, in the phone's protected storage (Keychain / Keystore), for this device only.
• Your settings (theme, vibration, date of the last backup).

Sent to your organisation's sign-in server

• At setup: the public half of the phone's keys, the phone's name and type (iPhone or Android) and its notification token.
• When you answer a request: your answer, signed with the phone's key.

The app fetches each sign-in request (the application, the address and browser it came from) directly from your organisation's server, over an encrypted connection. These details are never sent through IDentify.

The app has no analytics, crash-reporting or advertising code, and IDentify does not sell or share personal data.

Notifications

To wake your phone when a sign-in request is waiting, your organisation's server asks the IDentify notification relay to send a notification. The relay passes it to Google Firebase Cloud Messaging, which delivers it (through Apple's notification service on iPhone).

• The notification only says "Sign-in request: open IDentify to approve or deny it". It carries no names, applications, addresses or numbers.
• The relay receives only the phone's notification token and type. It does not store tokens; its operational logs show the last 6 characters of a token, the organisation and whether delivery worked, and are deleted after 30 days.
• Google and Apple process the notification token to deliver notifications, under their own privacy terms.

You can turn notifications off in your phone's settings. The app still finds waiting requests while it is open.

Backups of your codes

If you choose to back up your offline codes, the app encrypts them on your phone with a passphrase that only you know (AES-256 with a key derived from your passphrase), and you choose where the file goes, such as iCloud Drive, Google Drive or Files. IDentify never receives the file or the passphrase and cannot open or recover it. Approval keys are never in a backup.

Phone permissions

• Camera: only to scan the setup code on your sign-in screen. Images are not kept or sent anywhere.
• Face ID / fingerprint: checked by your phone's operating system. The app only learns whether the check succeeded and never receives biometric data.
• Notifications: to show sign-in requests, as described above.

This website

The site sets no tracking cookies and uses no analytics. If you send the "Request a demo" form, we keep what you entered (name, e-mail, organisation, interest and message) with the address, country and browser it was sent from, to answer you and protect the form from abuse. It is stored with our hosting provider, Cloudflare, and may be e-mailed to our team. Fonts are loaded from Google Fonts.

Keeping and deleting

• Removing an account in the app deletes its data and keys from the phone. Uninstalling the app removes its data; on iPhone, protected Keychain entries may remain until the phone is reset, and are unusable without the app.
• Your organisation can remove your phone at any time; its keys and codes then stop working.
• The notification relay's logs are deleted after 30 days.
• Demo requests are kept as a record of our contact with you, and deleted when you ask (write to privacy@identify-sso.com).

Your rights

Depending on where you live, you may have the right to ask for access to, correction of or deletion of your personal data, or to object to how it is used. For the sign-in records of your organisation, ask your organisation. For anything IDentify holds (the relay and website), write to us.

Contact