With fingerprint or Face ID
Your key sits in your device's secure element – it never leaves. No passwords to steal, no phishing risk. SMS-TAN never as a high security level.
Security
Protection that grows with you.
Confirm with fingerprint or Face ID – no more passwords. Every critical action gets proof. Security here isn't an add-on, it's the architecture.
Servers in Germany · Proven crypto library · Standard FIDO2
Security stack
How we secure it
Proven crypto. No home-grown stuff.
Three building blocks. Every critical action runs through them.
Trust App with proof
Before you confirm an IBAN, admin role or API key, you see the amount, recipient and action. What you see is what you sign – tamper-proof.
An audit trail that can't lie
Every proof hangs on the previous one. Anyone trying to change something would have to recompute the whole chain – it shows immediately. Re-verification any time, even years later.
Threat model
Four steps against trust loss.
This is how every critical action runs at SigID — from identity anchor to audit-grade proof.
Identity
Person and device are bound via passkey. No shared secrets.
Verify
Action data (IBAN, amount, authorization) is checked and packaged into a Challenge.
Sign
Trust App signs the Challenge on the device — with dynamic linking to the concrete action data.
Audit
Signature is appended to the audit trail. Audit ID enables external re-verification, even years later.
Common questions
What security teams ask most often.
Five questions that come up in every pilot discussion — answered directly.
What happens if the passkey is lost?
Recovery only works through the four-eyes principle — either a second authorized member of the organization or a pre-registered recovery contact. No email reset, no hotline.How do we export audit data for financial audits?
Via the API as a signed JSON or PDF with Audit IDs. External re-verification possible without SigID. Retention periods configurable.Where is our data stored?
Cloud variant: Hetzner Falkenstein and Nuremberg, Germany. Enterprise customers get a dedicated EU tenant in the same region. No customer plaintext leaves the EU without explicit consent.How quickly are we informed about a security incident?
24h first notice, 72h detailed report — per NIS2. Status page + email to all affected customers. Public post-mortem for SEV-1 within 14 days.
Audit whitepaper for your security review.
Threat model, crypto stack detail, SBOM and pen-test reports in one PDF. Prepared directly for CISO reviews.
- DSGVO-konform
- eIDAS-bereit
- Made in Germany