Work moved to the browser. Any device, anywhere.
MFA, passkeys and SSO now sit across many providers. Security means protecting every single login.
NEWUniqkey Discovery
SaaS & AI Governance Tool. See every login, and how it's protected.
Discovery maps every SaaS and AI service your people sign in to and shows which logins run without MFA, passkeys or SSO. IT teams get audit-ready evidence from day one, with nothing to implement and no employee monitoring.
Trusted by 1k+ European organisations · 4.7/5 on
The perimeter moved to the login.
Most of those logins never reach IT.
Cloud use nearly tripled in a decade, and teams now adopt tools in minutes.
2014
18% of EU enterprises paid for cloud
2025
+200
53% pay for cloud servicesSource: Eurostat, Feb 2026
Logins are the way in. Stolen credentials start most intrusions.
~60%Intrusions starting with phishing
47%Rank supply-chain attacks a top concern
e-conomic · FinanceJonas logged in without MFANo MFADropbox · File sharingExposed password detectedCompromised
Asana, Slack, Miro, CanvaEmma reused one password 4 timesReusedSources: ENISA Threat Landscape 2025 · ENISA NIS Investments 2025
AI is the headline. SaaS is the story.
New AI tool detectedDeepSeek · 4 peopleNot approved
42% assume staff use private AI tools
AI usage policy
23% have rules in place
Every AI tool is a login. Govern the logins and you govern AI, plus the services nobody talks about.
Source: Bitkom, 2025 · German companies
Five questions your auditor will ask.
How many can you answer today?
Detect · React · SecureFive blind spots. One view.
Five blind spots. One view.
Built from your own daily login data, not surveys or last year's spreadsheet.
Detect · SaaS inventoryEvery service,
Every service,
found and mapped.
Every service your people sign into is discovered from real sign-ins. Shadow IT and shadow AI are flagged the moment they appear.
Answers: “What are we actually using?”
Your peopleShadow AI
Approved apps
New this week
Private accounts
Business-critical
Shadow IT
React · MFA adoptionMFA proof on every
MFA proof on every
critical login.
See whether MFA was used per service and per user, including finance, CRM and industry portals outside Microsoft and Google. Export it as evidence.
Answers: “Can we prove MFA on critical services?”
eSign in to e-conomic
jonas@northwind.dk••••••••••
No MFASigned in with a password only
MFA evidence · e-conomicExport PDF
Anna PoulsenMFASofie HolmPasskeyJonas KroghNo MFAReact · Passkey adoptionPasskeys under
Passkeys under
company control.
Spot passkeys synced to personal Apple or Google accounts, before someone leaves and takes access to your own service with them.
Answers: “Who owns the passkeys we depend on?”
mikkel@northwind.dkGitHubPasskey ••••••
Outside company controlSynced to personal iCloud
Move to a company account
Access lost when Mikkel leaves
React · SSO coverageSSO coverage,
SSO coverage,
measured from real use.
Your identity provider reports on what is connected to it. Discovery shows the unmanaged long tail, and which of it is business-critical.
Answers: “How much does SSO really cover?”
Identity provider
Through SSO · 68%
Microsoft 365
Slack
HubSpot
Outside SSO · 32%
Dropbox
Canva
Ccarrier-portal.eu
Only Discovery sees theseSecure · Security overviewOne score for how
One score for how
your company logs in.
An organisation security score, login methods per service and password strength, scored without ever seeing a password. Then the areas to fix first.
Answers: “How securely do our people log in?”
53/100
Organisation security score+4 this month
Lowest scores · start here
JonaseNo MFA on e-conomic31EmmaOne password reused 4 times42
OliverShadow AI on a private account48Coverage your identity provider can see.
68%Logins through SSO
32%Logins outside SSO
Identity provider
Sees 68% of logins
Sees 68% of logins
Uniqkey Discovery
Sees 100% of logins
Sees 100% of logins
Illustrative split, measured by Discovery from real sign-ins.
The SSO blind spot · illustrative split
"We have SSO" isn't coverage.
Your identity provider tells you about the apps connected to it. Discovery tells you about everything else.
The long tailNiche tools, trials and partner portals stay on separate passwords.
The SSO taxSSO is often sold only in premium plans, so many services never get connected.
The reporting gapAn identity provider can only report on what's connected to it.
Live in minutes.
Nothing to implement, nothing to disrupt.
01 · Install once
Install once, through your MDM.
Rolled out centrally to company browsers with your existing device management. Nothing for employees to install or click.
02 · Passive detection
Every sign‑in, mapped automatically.
Services, logins and authentication methods are picked up from daily use. No API connector to set up per app.
03 · Take action
Close the gaps that matter.
Review the dashboard, export audit-ready evidence and fix the riskiest logins first.
One view, for everyone who answers for security.
From the IT desk to the boardroom.
A daily overview of every login, without the spreadsheet.
Discovery forIT managersLess manual work
Evidence and priorities, built from real sign-ins.
Discovery forCISOsRisk and evidence
★★★★★4.7/5 on G2.
Uniqkey is loved by our customers.
- 9.6
- Ease of use
- 9.5
- Quality of support
- 8.9
- Ease of setup
G2Reviews
Board reporting built on facts, not estimates.
Discovery forCEOs and boardsAccountability
Visibility without surveillance, ready to share.
Discovery forDPOsPrivacy by design
Visibility, not surveillance.
Discovery answers one question: which services you log into, and how well those logins are protected.
What Discovery records
Sign-in events, and nothing else.
- The service signed in to
- How the login was made
- Whether MFA or a passkey was used
- Password strength, scored without seeing it
- Whether the sign-in succeeded, and when
What it never collects
Not at any point, in any form.
- Passwords
- Page content
- Emails, messages or documents
- Keystrokes
- Screenshots
- General browsing history
Company domains are mapped.
Private domains stay private.
Company domain
Private domain
Sign-in detected and countedEvery sign-in to a company account is mapped and counted.
Counted anonymouslyOnly ever appears in an organisation-wide total.
Username or email collectedEach login is tied to the employee's work account.
No username or emailNothing that identifies the person is collected.
Identity visible to administratorsIT can see who uses which service.
No identity shownAdministrators never see who signed in.
Login detail visible to administratorsLogin method, MFA, passkey use and password strength.
No login detailHow a private account signs in stays private.
When an SSO sign-in is linked to a person, it is marked as an inference and only shown for company domains.
Built in Europe. For Europe.
Your login data never leaves it.
Discovery is built and operated by Uniqkey, a Danish company. Every sign-in it maps stays under European jurisdiction, owned by you.
Stored in the EU.
Under European jurisdiction, with no transfer to third countries. Hosted with IONOS.
You own the data.
Uniqkey processes it only to deliver the service, under a Data Processing Agreement.
Ready for your DPO.
Share the Data & Privacy FAQ. DPA and sub-processor list on request.
Continuous evidence for NIS2.
And for ISO 27001, SOC 2, DORA and GDPR, month after month.
Why it landsUp to €10m or 2% of global turnover
Maximum NIS2 fine for essential entities. Important entities face €7m or 1.4%. Management can be held personally accountable.
Also useful for customer security questionnaires, cyber-insurance applications, supplier audits and board reporting.
Discovery supplies visibility and evidence. It doesn't make an organisation compliant on its own. Sources: Directive (EU) 2022/2555 Art. 20, 21, 34; Regulation (EU) 2022/2554.
From findings to fixes.
An overview is a snapshot. Auditors expect ongoing control.
Discover. See the gaps across every service.
Prioritise. Critical services and risky habits first.
1ee-conomicNo MFA
2DropboxExposed
3ChatGPTShadow AI
Close. Enforce MFA, assign owners, move to SSO.
Enforce MFA · e-conomic
OwnerJonas Krogh
Jonas KroghMove Dropbox behind SSO
Uniqkey can secure passwords, 2FA and sharing.
Prove. Show the improvement over time, ready for your auditor.
JanFebMarAprMayJun
68% → 91% logins with MFAExport evidence
Example finding. Nearly one in three logins skip MFA.
68%Logins protected by MFA
Recommended action: prioritise high-activity services without MFA, enforce it where supported, assign an owner and track coverage until the gap is closed.
One price per organisation.
Set by headcount, not by seat.
Live in minutesRolled out through your MDM, with nothing to implement
See what Discovery costs for your organisation.
Adjust the slider to get your price. Count all employees, not just IT users.
Your tier
Includes the SaaS and AI inventory, MFA, passkey and SSO coverage, the security score, audit-ready exports, EU hosting and a DPA.
€479per month · €5,748 per year · ≈ €2.66 per employeeList price in EUR, excluding VATBook Discovery demo
Still have questions?
No problem.
Talk to an expert, or share the privacy FAQ with your DPO.
Is this employee monitoring?
No, and it isn't built to be. Discovery sees sign-in events only. It never sees browsing, productivity data, keystrokes or screenshots.
Does Discovery see our passwords?
Never, in any form. Password strength is scored without Discovery ever handling the password itself.
What about employees' private accounts?
Protected. On non-company domains no username or email is collected. Those sign-ins only appear anonymously in an organisation-wide count.
Where is the data, and who owns it?
In the EU, under European jurisdiction, with no transfer to third countries. You own the data, and Uniqkey processes it only to deliver the service, under a DPA.
How much work is the rollout?
Very little. It's deployed centrally through your existing device management, with nothing for employees to install or click. Data starts flowing from the first logins.
Do we need to be a Uniqkey customer?
No. Discovery works on its own and is priced per organisation. For Uniqkey customers it shows where to extend protection, and proves the effect.
Can't we cancel once we have the overview?
Then you're back where you started. New services are adopted every week, so an overview is a snapshot. Auditors, ISO certification and NIS2 expect ongoing control, not a one-off list.
Why not just use our identity provider's reports?
An identity provider reports on the apps connected to it. Discovery measures every sign-in, including the services that never got connected.
