Who we are
Hardware-rooted security engineers.
The security business unit of Ambimat Electronics — an embedded engineering team shipping electronics since 1981 and identity systems since 2017.
Identity infrastructure for connected systems
AmbiSecure builds hardware-rooted identity, FIDO, PKI & smart-card systems.
FIDO authenticators, PIV applets, PKI infrastructure, JavaCard platforms, Secure Elements, ePassport systems, and IoT trust anchors — engineered for governments, enterprises, telecoms, and connected-product OEMs.
FIDO
PIV
PKI
JavaCard
Secure Elements
ePassport
IoT Security
About AmbiSecure
Engineering-led identity infrastructure.
What we build
FIDO, JavaCard, secure elements, PKI.
FIDO2 authenticators, JavaCard applets, ePassport platforms, IoT trust anchors, and validation servers — rooted in CC EAL5+ silicon.
Who we help
Governments, enterprises, OEMs, telecoms.
National identity programmes, enterprise IT, telecom operators, transit authorities, connected-product OEMs, and security integrators.
How we help
Turnkey, from wafer to validation.
Silicon selection, applet engineering, personalisation lines, form-factor delivery, and validation servers — scoped as review, pilot, or rollout.
Featured highlights
Integration flexibility · nano-card · MFF2 solderable
Same applets. Card or solderable. Your choice of integration.
FIDO2, PIV, OpenID Connect, and IoT-identity applets ship on the same CC EAL5+ secure-element silicon in two packages: a nano-card form factor for issuance and handling, and a solderable MFF2 module for embedding directly into connected-product boards. Same applet code, same certifications, same personalisation pipeline.
- FIDO2 / PIV / OIDC applets on CC EAL5+ silicon
- Nano-card package for removable handling
- MFF2 solderable for embedded OEM integration
- SGP.22 / SGP.32 RSP supported via the SIMAuth sister platform
Core pillars
Eight domains, one engineering team.
V2X / Connected Mobility
Secure-element integration, V2X PKI architecture, and OBU/RSU hardware identity for ITS.
FIDO / WebAuthn
Authenticators, validation server, attestation, MDS — with a public utility-tool surface.
JavaCard
Custom applets, CAP file delivery, SCP03 loading, JCOP 3.1, JavaCard 3.x.
DESFire / Transit
EV1 / EV2 / EV3, SAM-backed offline trust, low-latency fare validators.
PKI / Certificates
Hardware-protected signing keys, PKCS#11, eIDAS-compatible flows, audit-grade issuance.
Secure Elements
CC EAL5+ silicon, attestation, key rotation, signed update — the foundation beneath every pillar.
eSIM Security
SGP.22 / SGP.32 eUICC platform, OpenID Connect applet, automotive + M2M variants.
OnePass Ecosystem
The flagship product family — Card, Bio Card, USB Key, BioKey, and Tappable.
What we build
Six surfaces, one trust chain.
Every product and service plugs into the same architecture — identity that begins in silicon and travels intact to the application layer.
FIDO Authenticators
OnePass Card, Bio Card, USB Key, BioKey, Tappable — FIDO2 / U2F, hardware-bound credentials, no shared secrets.
JavaCard Applets
FIDO, PIV, OpenPGP and custom applets — designed, written, loaded, and personalised on chips at scale.
IoT Security Co-Processor
Dual-domain co-processor — the MCU runs the application while the cryptographic domain holds keys, verifies OTA, and anti-replays. Identity below the firmware.
FIDO Validation Server
Multi-tenant FIDO2 / WebAuthn SaaS. Per-tenant policy, attestation verification, MDS lookup. Drop-in JS + tenant-scoped REST.
ePassport Platform Engineering
End-to-end ICAO 9303 platform — backend, frontend, CSCA / DSC / PKD PKI, enrolment, personalisation.
eSIM & eUICC
Telecom-grade embedded identity, eSIM/eUICC architecture, profile lifecycle — explored on our dedicated SIMAuth site.
Trust chain
A chain that begins below the operating system.
Software-only security inherits every weakness of the host. We anchor trust in a tamper-resistant Secure Element, then carry it up through firmware, OS, and application boundaries with verifiable transitions.
Silicon — Secure Element / eUICC
ROOT OF TRUST
Boot ROM & signed bootloader
VERIFY
Firmware — signed, anti-rollback, recoverable
MEASURE
OS / Runtime — isolated, attestable
ATTEST
Application — FIDO, PKI, payment, identity
CONSUME
Solutions
Problems we are good at.
Passwordless & MFA
Replace shared-secret passwords with hardware-bound FIDO2 credentials. Phishing-resistant by construction.
Secure-element integration
Adding a secure element to a connected-device BOM — from silicon selection to SMT-line personalisation.
Smart-card personalisation
Personalisation lines for cards and devices — key splits, HSM-backed custody, audit trails, batch APDUs.
Government identity
PIV, OpenPGP, and eID applets on smart cards and tokens — issuance and revocation that holds up to audit.
Closed-loop ticketing
SAM-backed transit and access systems with offline trust and audit-grade tap journals.
Secure validator platforms
Reader-and-SAM platforms for fare collection and access — built to keep working when the backend doesn’t.
Ecosystem map
Explore the platform.
Four ways into the same trust chain — by product, by audience, by standard, or by stack layer.
By product
Cards, USB keys, biometric tokens, secure-element applets, IoT applets, signature suites — all the hardware AmbiSecure ships.
By service
JavaCard development, FIDO validation server, tool-chain engineering, ePassport platform — engineering work AmbiSecure does directly.
By solution
Passwordless workforce, closed-loop transit, government identity, IoT trust, phishing-resistant MFA — problem-shaped views.
By technology
FIDO2, WebAuthn, CTAP2, passkeys, JavaCard, DESFire, secure elements, SAMs, attestation — the standards layer.
By industry
Government, enterprise IT, transit, IoT/industrial, telecom — vertical-specific deployment shapes and constraints.
By reference
AAGUIDs, APDU status, ASN.1, ISO 7816, COSE, X.509, GlobalPlatform, EMV, NFC, CAP files, DESFire — searchable databases.
By tool
54 client-side utilities for parsing, decoding, building, and signing — the engineer’s toolbox.
By article
21 modern engineering deep-dives plus 24 archived posts — cornerstone reading on FIDO, JavaCard, PKI, transit, IoT.
Resources
A toolbox for the engineers building this stack.
Free, client-side utilities for parsing the hex you stare at every day. Nothing leaves your browser. No accounts, no ads.
ATR Parser
Decode Answer-To-Reset bytes — TS, T0, interface bytes, historical bytes, TCK.
APDU Parser
Decode CLA / INS / P1 / P2 / Lc / Le for Case 1–4, short and extended.
TLV Parser
Walk BER-TLV, EMV TLV, and DGI-TLV trees with tag dictionary lookup.
Browse all 39+ tools
Utilities for ASN.1, CBOR, COSE, AAGUID, X.509, SCP03, NDEF, DESFire, EMV, and more.
Explore by use case
Where AmbiSecure ships today.
IDENTPasswordless enterprise
IDENTPhishing-resistant MFA
EMBEDFIDO2 in a nano-card / MFF2 secure element
GOVPIV in a nano-card / MFF2 secure element
GOVePassport platform engineering
PKIEmail + document signing
PKIPKCS signature suite
IoTIoT security applets
TRANSITClosed-loop ticketing
SILICONSecure-element integration
SAASFIDO validation server
Why AmbiSecure
An embedded team, not a security boutique.
Forty years of shipping hardware that survives the field.
AmbiSecure is the security business unit of Ambimat Electronics — established 1981. We have shipped firmware, contactless modules, and GSM/Bluetooth platforms for medical devices, wearables, and utilities. Security is engineered into that DNA, not layered over someone else’s reference design.
- One point of contact from spec to shipment.
- In-house JavaCard, FIDO, and personalisation expertise.
- Real vendor relationships across silicon, contactless, and biometrics.
From the engineering blog · rotates daily
Featured technical reads.
FIDO2
Implementing FIDO2 Authentication: A Complete Developer Guide
A walkthrough of the FIDO2 stack — CTAP2, WebAuthn, attestation — with code that compiles.
Read → MFAWhy use Multi-factor Authentication?
Cybercriminals have billions of leaked records. Why a second factor — especially a hardware-bound one — cuts off the long tail.
Read → MFATop 3 Benefits of Multi-factor Authentication
The three reasons MFA isn’t optional any more — and what changes when the second factor is hardware.
Read →
Videos
See it in action.
FIDO setup walkthroughs, multi-application card use cases, and product loops — under 90 seconds each.
AmbiSecure card — all use cases
FIDO, PIV, door access, NDEF, and OpenPGP roles on a single multi-application card.
View page →
Set up the AmbiSecure card on Gmail
Adding the card as a FIDO security key on a Google account, on desktop.
View page →AmbiSecure BioKey — product loop
Short hero loop showing the biometric USB security key.
View page →
Where AmbiSecure fits
From wafer to user, in one stack.
AmbiSecure sits between the silicon vendor and the application developer — picking the chip, writing the applet, running personalisation, shipping the authenticator, and standing up the validation server. Steps that are usually each their own RFP.
01
Silicon
CC EAL5+ secure element from a partner vendor.
→
02
Applet
FIDO, PIV, OpenPGP, NDEF, OIDC, IoT — AID-selectable on one chip.
→
03
Personalise
SCP03 loading, per-card key derivation, AAGUID + attestation cert injection.
→
04
Form factor
Card, USB key, biometric variant, NFC fob — brandable.
→
05
Validate
FIDO Validation Server with REST + JS API — or your own RP.
Trust center
Certification posture, standards conformance, security model, and vulnerability disclosure.
Certifications
What we are certified for, the standards we build to, and what we are targeting — with explicit disclaimers.
Partners
Resellers, OEMs, system integrators, MSSPs, and consultancies — the partner programme front door.
How engagements work
Three places to go next.
Evaluating whether AmbiSecure fits your deployment? These three surfaces are the most useful next step — architecture studies, platform overviews, and engagement-model shapes.
Case studies
Three anonymised deployments — passwordless workforce, closed-loop transit ticketing, IoT device identity. Architecture-led.
Brochures
Six platform overviews — OnePass, FIDO, transit, JavaCard, PKI, device identity. Printable, no lead-capture wall.
Engagement models
How engagements are scoped — architecture review, pilot, rollout, integration, secure manufacturing, custom JavaCard.
Frequently asked
Questions evaluators ask first.
What does AmbiSecure build?
Hardware-rooted identity systems — FIDO2 authenticators, PIV smart cards, JavaCard applets, ePassport platforms, eSIM and secure-element authentication, PKI, and IoT trust anchors — for governments, enterprises, telecoms, and connected-product OEMs.
Is AmbiSecure a hardware vendor or a software vendor?
Both, by design. AmbiSecure ships JavaCard applets, FIDO Validation Server software, and tool-chains on top of certified secure-element silicon. The promise is wafer-to-validation in one engineering team rather than three vendor handoffs.
Which standards and certification regimes does AmbiSecure align with?
FIDO2 / WebAuthn / CTAP2, PIV / FIPS 201, JavaCard 3.x with GlobalPlatform and SCP03, IEEE 1609.2 for V2X PKI, GSMA SGP.22 / SGP.32 for eSIM, ICAO 9303 for ePassport, and CC EAL5+ secure-element silicon. Posture is documented on the trust center.
Who is AmbiSecure built for?
Engineering and procurement teams that need device-bound rather than syncable identity — connected-mobility OEMs, transit operators, government identity programmes, telecom eSIM rollouts, and security leads who evaluate against threat models rather than feature lists.
How do AmbiSecure engagements typically start?
Most start as “we need something like X but with Y.” Tell AmbiSecure about the Y — there is usually an applet, a tool, or a secure-element pairing that gets you most of the way there. See the engagement models for the usual shapes.
Have a security problem that lives in hardware?
Talk to engineers, not BDRs. Tell us what you are building and we will tell you what is realistic, standards-aware, and shipped before.