Security and limitations

Passkeys, Face ID and two-step verification

• With a passkey you confirm with Face ID, fingerprint or your device PIN. That check happens on your device; the website never receives a face scan or fingerprint, only a signature.
• Passkeys can sync between your devices (for example via iCloud or Google). Two-step verification with an authenticator app also protects your password. We do not offer text-message codes because of SIM-swap fraud.

What a confirmation does and does not mean

• A confirmation means: this exact request was confirmed through the previously paired account and its passkey.
• It does not mean the message is true, that the person is not under pressure, that an account number is correct or that a payment is safe.

Hacked WhatsApp, website or phone

• Always pair outside a channel that could be hijacked: side by side, or via a phone number you already knew.
• Your contact's hacked phone can also give a confirmation. And because Torivela runs in the browser, a hacked website could show different text than what is signed. A separate confirmation app that protects against this better is being designed and is not available yet.

AI help versus cryptographic check

The assistant gives explanations and tips; that is an estimate, not a check. Only a passkey confirmation from your paired contact counts as a confirmation. The assistant cannot approve anything.

In case of fraud or doubt

Stop, call back yourself on a known number, share no codes, and if a payment is involved call your bank straight away on the number on your card. In the Netherlands: Fraudehelpdesk (fraudehelpdesk.nl) and police (politie.nl, 0900 8844; emergency 112). See also ‘I don't trust this’.

Lost device

Report it in the Security centre. Your passkeys are revoked, pairings paused and your contacts warned. After 24 hours you pair again in person.

What we do not claim

No independent security test (pentest), audit or certification has been done. That is why we do not call Torivela ‘unhackable’, ‘100% secure’ or ‘bank-grade’.