VERISCO Shield Get started
VERISCO Shield documentation
Shield puts sign-in, multi-factor authentication, device and network policy, and an audit trail in front of an application you already run, without moving a single user out of your own database.
What Shield does#
Your application already has users, in your own MySQL database or your LDAP directory. Shield does not ask you to migrate them. It verifies each password against that directory, where it lives, and adds everything a modern sign-in needs around it:
- a branded sign-in page with captcha, password rules and lockout;
- five multi-factor methods, including passkeys;
- network policy (countries, networks, VPN and Tor) and device posture checks;
- sessions you can see, end, and bind to the network they started on;
- a record of every decision, and a tamper-evident log of every change.
Your application then receives one thing: a signed statement of who the user is. It verifies the signature with a public key and never handles a password again.
What it looks like#
Start here#
- Quickstart From an invitation to a protected application, in order.
- Deployment modes Gateway, connector or SDK, and what each one guarantees.
- Read the signed-in user The header, the cookie and the claims your code receives.
- Multi-factor authentication The factors, what each one needs, and what your users see.
- API reference Every endpoint your application or the CLI calls.
- Troubleshooting The causes behind "nobody can sign in" and "one person cannot".
Who does what#
| You | VERISCO | |
|---|---|---|
| Users and passwords | Stay in your database or directory. | Reads them to check a password. Does not copy them. |
| Sign-in page | Choose its colours, logo and factors. | Hosts it, with captcha, lockout and MFA. |
| Your application | Verifies a signature and reads the user. | Signs the user's identity for it. |
| Policy | Decide what is allowed, in your console. | Evaluates it on every sign-in and records why. |
| Evidence | Export it and check it yourself. | Keeps a hash-chained log of every change. |
Where a control is enforced#
Not every control is enforced in the same place, and the documentation says which each time. There are four possible answers:
| Level | Meaning |
|---|---|
| Not available | This deployment mode cannot provide it. The page says which mode does. |
| Enforced by VERISCO | Applied in front of your application, before your code runs. Nothing you deploy can switch it off. |
| Enforced at sign-in | Applied on the sign-in page, which every deployment mode shares. |
| Enforced in your app | Applied by the VERISCO middleware inside your application. Correct while it is mounted. |
Which level you get depends on your deployment mode. Your console shows the same label on every control.
Plans#
Everything that happens at sign-in is in every plan. The controls that keep working after sign-in, and the tools for responding, are in Premium. Pages that describe a Premium feature are marked. See Plans and billing.
Something missing or wrong on this page? Tell us and we will fix it.