Vaultys in Point Éco Alsace: taking back control of our digital identities
A full page dedicated to a problem that hides behind a large part of cyber incidents: identity. In its issue 81 of May-June 2026, the magazine Point Éco Alsace features an interview with Jean Williamson, co-founder of Vaultys. The article discusses the limits of passwords, the fragility of centralized identity databases, and Vaultys' choice: a cryptographic, passwordless identity controlled by its holder.
Point Éco Alsace gives the floor to Vaultys
Entitled “Vaultys: take back control of your digital identities”, the interview was conducted by Silvia Bosnea for the CCI Alsace Eurométropole media. It is published in the Digital section and presents Vaultys from Haguenau, at the heart of the Alsatian ecosystem.
This spotlight goes beyond media recognition. It gives space to a question that has become strategic for SMEs as well as large groups: who really controls the identities that open the doors to the information system?
Because behind a spectacular attack, there is often a much more mundane mechanism: a reused password, a stolen session, a forgotten account, or an identity repository that has become a very high-value target.
The problem is not just the password: it's also where trust is concentrated
The first observation discussed in the interview is architectural. In many organizations, credentials, authentication secrets, and a large part of trust are grouped around the same directory or identity provider. This centralization makes administration easier, but it also concentrates risk: compromising the right point can open up a very wide perimeter.
Detection layers, conditional policies, and MFA do genuinely reduce certain attacks. They remain useful. But they do not eliminate reusable secrets, exploitable sessions, or the value of the central database for an attacker. MFA is a control; on its own, it does not constitute a complete architecture for identity sovereignty and governance.
"Adding extra locks is not enough if the object of desire remains the same."
Jean Williamson, interview published by Point Éco Alsace
Key idea. Strengthening a central point may be necessary. Reducing the amount of concentrated and transferable secrets, however, changes the very structure of the target.
Moving from a shared secret to a cryptographic proof
The approach presented by Vaultys involves assigning each user a unique digital identity, linked to a pair of cryptographic keys and stored on their device(s). Authentication no longer relies on a reusable secret that the user enters and that the service must store a verifier for or delegate validation to a central provider.
During login, the challenge is no longer to answer the question "what password do you know?", but to cryptographically prove "do you really control the key associated with this identity?". The private key is not transmitted to the service; it is used to produce a verifiable proof for the relevant exchange.
This peer-to-peer logic forms the foundation of VaultysHub. The platform maintains a unified console to manage applications, permissions, onboarding, offboarding, Shadow IT, and traceability. For accesses compatible with cryptographic authentication, it does not need to centralize users' passwords in a central identity database.
The distinction that changes everything. Vaultys centralizes the governance and visibility the company needs; identity and authentication proof remain decentralized. Governing from a single place does not mean concentrating all secrets in one place.
Centralization VS decentralization
Simple, secure, and sovereign: three principles, not three slogans
Jean Williamson summarizes the Vaultys philosophy around three principles. They take on their full meaning when translated concretely into an organization's operations:
- Simple for the user. Fewer passwords to create, remember, share, reset, or enter. Security no longer depends on perfect human discipline at every login.
- More secure against credential attacks. Proof relies on the control of a cryptographic key rather than the presentation of a copyable secret. The absence of a central password database notably reduces the potential for a massive credential theft.
- Sovereign through control. Sovereignty is not limited to the country where a server is installed. It also concerns control over identities, keys, policies, logs, portability, and the ability not to be irreversibly dependent on a hyperscaler.
“Secure” obviously does not mean invulnerable. Endpoint protection, key recovery, least privilege, and monitoring remain essential. The value of the model is to reduce dependence on a shared secret and to limit the blast radius of a compromise, not to promise the magical disappearance of cyber risk.
From post-quantum to securing AI agents
The final part of the interview looks toward future threats. Jean Williamson explains that Vaultys solutions already integrate a post-quantum dimension and recalls the work carried out with the French Alternative Energies and Atomic Energy Commission on securing and controlling AI agents within companies.
This extension is logical. An AI agent no longer simply connects: it calls APIs, accesses data, uses tools, and triggers actions on behalf of a person or organization. It must therefore have a verifiable identity, strictly limited rights, a traceable delegation chain, and revocable access at any time.
This vision is now materializing with VaultysClaw, the Vaultys control plane to assign a cryptographic identity to agents, govern their permissions, trace their actions, and cut their access when they operate outside the authorized scope.
Same principle, new scope. Whether it's a collaborator, a machine, or an AI agent, the question remains the same: who is acting, on whose behalf, with what rights, on which resource, and for how long?
Diagram of the AI agent architecture
An Alsatian innovation designed to go beyond regional borders
Based in Haguenau, Vaultys claims a French and independent foundation. The interview also highlights the support of Bpifrance and Alsace Business Angels, which helped accelerate the development of the technology.
Being featured in Point Éco Alsace, the economic showcase of the CCI Alsace Eurométropole, is therefore doubly significant: this publication highlights a local business and brings the sovereignty of digital identities into the regional economic debate.
Taking back control of your digital identity
“You are no longer just a tenant of a Mac or Windows account. You are taking back control of your digital identity.”
=====> Jean Williamson, Point Éco Alsace No. 81
This sentence sums up Vaultys' ambition: to make identity an asset controlled by its holder and governed by the organization, rather than a simple account dependent on a provider. An identity that can be used to authenticate a human today, and a machine or autonomous agent tomorrow.
To learn more. Read the full interview in Point Éco Alsace, see the LinkedIn post, then discover how VaultysHub applies this architecture to daily identity and access management.