Vaultis gives banks and fintechs passkey login and payment signing in one platform. Customers sign in and approve payments with Face ID or a fingerprint. Every approval is cryptographically tied to the amount and the payee, so a changed payment is a rejected payment.
One-time codes can be phished, intercepted through SIM swaps, or simply read out to a fraudster on the phone. Passwords are reused, stolen and reset at real cost to your support team. Every extra step also costs you customers at the moment they want to pay.
A fake login page collects the password and the SMS code in seconds.
Whoever controls the phone number receives the code.
Waiting for a code at checkout is where good payments are abandoned.
Replace passwords and SMS codes with Face ID or a fingerprint. Phishing-resistant by design, on mobile apps and the web, including sign-in on a new laptop using the customer's phone.
Every payment is shown to the customer and signed on the phone with a key that never leaves the device's secure chip. The signature is linked to the amount and the payee. If either is changed, the payment is blocked.
Decide how much assurance each action needs. Viewing a balance, paying a known payee and sending a large transfer to a new account can each require a different level of proof. Rules are set by your team, not hard-coded.
Vaultis checks that the request comes from your genuine, untampered app on a real device, using Apple App Attest and Google Play Integrity. Rooted phones, emulators and cloned apps are detected and handled by your policy.
The customer starts a payment in your app. Your system sends the details to Vaultis, which creates a one-time code linked to that exact amount and payee.
The Vaultis screen shows the customer what they are about to approve: the amount, the payee name and the account number.
The customer confirms with Face ID, a fingerprint or their phone passcode. The phone's secure chip signs the payment. The private key never leaves the chip.
Vaultis checks the signature against the original payment and confirms it to your core banking system. If anything was changed on the way, the payment is rejected and your fraud team is alerted.
One code per payment, valid for two minutes, usable once. A copied or replayed approval is worthless.
| Generic passkey login | Vaultis | |
|---|---|---|
| Passwordless, phishing-resistant login | ✓ | ✓ |
| Payment approval linked to amount and payee | ✗ | ✓ |
| Device-bound signing key in the phone's secure chip | Not guaranteed | ✓ |
| App and device integrity checks | ✗ | ✓ |
| Risk-based rules by action and payment value | ✗ | ✓ |
| Full audit trail for fraud and compliance teams | Limited | ✓ |
| Regional data residency | ✗ | ✓ |
| Remote revocation of a lost phone in seconds | Limited | ✓ |
Vaultis works alongside the passkeys your customers already use with Apple and Google, and adds the payment-grade controls a bank needs on top.
Log in, check balances and send everyday payments with Face ID. No passwords to forget, no codes to wait for.
Ask for stronger proof only when it matters: adding a new payee, raising a daily limit or sending a large amount.
Require a device-bound key and a verified, untampered device for high-value clients and large movements of funds.
Approve batch payments by signing the total and the number of payments. Multi-approver rules for finance teams are on the roadmap.
Customers are identified by random references, not account numbers or email addresses. Vaultis is designed for GDPR and the UAE and Saudi personal data protection laws.
Every login and approval is logged with its result and the reason for any rejection, stored in tamper-proof archives for your fraud, audit and compliance teams.
If a customer reports a lost or stolen phone, your support team can revoke it from the Vaultis console in seconds.
Vaultis handles the complex cryptography and encoding so your team works with simple, well-documented calls.
Vaultis runs in dedicated regional cells. Each bank is assigned to one home region at onboarding, and credential data is never copied to another region.
Private and on-premises deployment options are available for Enterprise customers on request.
Meridian confirms that a phone number is genuine and has not been recently SIM-swapped, using mobile operator network signals. Use Meridian at onboarding and Vaultis for every login and payment after that.
Explore Meridian →For evaluation and prototypes.
For fintechs and digital banks going live.
For banks and regulated institutions.
A passkey is a digital key stored on the customer's phone or computer and unlocked with Face ID, a fingerprint or a PIN. It replaces the password. Because it only works with your genuine app or website, it cannot be phished.
Apple and Google passkeys handle login well. Vaultis adds what banks also need: payment approvals linked to the amount and the payee, a signing key that stays on one device, app and device integrity checks, risk-based rules, a full audit trail and regional data residency.
No. Biometric checks happen entirely on the customer's phone. Vaultis only receives a cryptographic signature that proves the check succeeded.
Yes. Vaultis is designed to support Strong Customer Authentication and dynamic linking. Each bank's compliance is confirmed by its own auditors and regulator, and we provide documentation to support that review.
Your support team revokes the phone from the Vaultis console in seconds. The customer then sets up a new phone through your identity verification process.
The phone falls back to its own passcode, which still meets two-factor requirements. You decide which actions allow the passcode fallback.
iPhones from iOS 16 and Android phones from Android 9, with all major browsers on the web: Chrome, Safari, Edge and Firefox.
A typical pilot integration takes a few weeks, depending on your app release cycle and internal approvals. The sandbox and demo app let your team start on day one.
In the region you choose at onboarding. Credential data is never replicated outside that region.
Vaultis is designed so that cryptographic algorithms can be changed without rebuilding the platform, and follows a published migration roadmap aligned with NIST and EU timelines.
We are working with a small number of banks and fintechs to shape Vaultis around real deployments. Design partners get early access, direct input into the roadmap and preferential commercial terms.
Book a 30-minute walkthrough with our team. We will show a live payment being signed, tampered with and blocked, and discuss how Vaultis fits your app and your compliance requirements.