Identity your security team will sign off on.
From the device's root of trust to the user's mobile-app login. One team, both ends, built for connected products that have to ship.
02 / Capabilities
What identity actually looks like, on both ends.
Specificity is the trust signal. Below is what an engagement leaves behind. Not "consulting," but the deliverables that go in the SOW and the line items your security reviewer ticks off.
User & mobile identity
- Passkeys / WebAuthn / FIDO2
- OIDC + social login
- Account recovery without lockout
- Session & token lifecycle
Device identity & root of trust
- Secure boot & attestation
- Secure-element provisioning
- Per-device key birth
- Anti-clone & supply-chain provenance
Authorization for fielded devices
- RBAC / ABAC for fleet access
- User ↔ device pairing & delegation
- Audit trail & forensics
- Time-limited & break-glass access
Cloud & API surface
- mTLS + service identity
- Signed payloads & replay protection
- Per-tenant isolation
- OWASP IoT Top 10 alignment
03 / Engagement models
Four ways to buy. Pick one.
Most identity work fails at procurement, not engineering. Each model below has a concrete shape so you know exactly what you'd sign and what arrives.
- Fixed-scope sprint
Pre-launch identity sprint
4–8 weeks, fixed scope. Threat model, identity architecture, code review across mobile + device + cloud, written sign-off doc your engineering team hands to their security reviewer. Most common engagement.
Sample SOW - Retainer
Embedded identity engineer
Senior cryptography + identity capacity that joins your launch team for a quarter. Standups, PRs, security questionnaire answers, the works.
Discuss retainer - One-shot
Security questionnaire battery
Pre-answered responses to the SOC 2, customer-procurement, FDA cyber, and ISO 21434 questions you'll hit. Sold as a single deliverable, ready before your first enterprise call.
Questionnaire intake - Partner
Device design partner
Multi-quarter, factory to field. Secure manufacturing + fleet identity + cloud auth designed as one system. The 'Gravexa runs your secure programming line and owns identity end-to-end' engagement.
Device intake
04 / Process
Four steps. Built to clear security review.
- 01 / Threat model
Humans, devices, services, abuse cases. We start where the attackers do and write it down for the team that has to ship.
- 02 / Design
Primitives, key custody, authentication and authorization. Chosen for the deployment, written for the engineers, not the auditors.
- 03 / Implement
PRs in your repo, alongside your engineers. Mobile, device, and cloud touched in the same engagement.
- 04 / Sign-off
Independent review, security-questionnaire battery, and the written package your security reviewer needs to clear the launch.
05 / Field notes
From the work, while it's still warm.
The connected-product security questionnaire, pre-answered
The 25 questions every enterprise customer, FDA reviewer, and app-store reviewer asks about your connected product, with the answer pattern that holds up under an AI-augmented review.
When your security reviewer has an AI
Something quietly shifted in 2026: the person reading your security submission is now reading it with help. Here's what that changes about how you prepare.
// open a brief
One conversation can save a quarter of engineering time.
Tell us what you're shipping. We'll tell you which decisions are load-bearing, which can wait, and where the cheapest reduction in risk lives.