Scope and handling
For critical operations, the user checks the details on screen and then signs with a passkey, bound to that operation. Business data stays with each app.
Passkeys
The private key stays on the user's device; Clavis holds only the public key. Every registration and every signature is confirmed on the device with a face, a fingerprint, or a PIN.
Critical operations
For the operations you designate, a session is not enough. A passkey signature bound to the operation is required as well.
Who holds what
Clavis handles identifiers, sessions, and signature records. Business data stays with each app.
Storage
Where data is stored, and for how long, is set out in the privacy notice and the subprocessor list.
Reporting a vulnerability
Write to [email protected]. How reports are handled is set out in our security policy.
Legal
- Privacy
- Legal documents
- Subprocessors