Security

Most security pages list reassuring words. This one tries to tell you what is actually in place, what it does, and what it does not do.

Getting into your account

• ✓A passcode you choose, required to open the app and to approve anything that moves money.
• ✓Face ID or fingerprint, if you turn it on. The check happens on your device and your biometric data never reaches us.
• ✓Your password is stored only as a one-way hash. Nobody at Vaultly can read it, including us.
• ✓Sessions expire, and signing in on a new device requires re-verification.

Proving you are you

Every account is verified before it can move money out. That means your BVN or NIN, a government-issued ID, and a selfie matched against it. It is a small friction for you and a large obstacle for someone opening accounts in other people's names.

Your connection and your data

• ✓Everything between your device and us travels over TLS. Nothing sensitive moves in the clear.
• ✓Access inside Vaultly is role-based. Staff see only what their job requires, and access is logged.
• ✓Every transaction writes an append-only record that cannot be edited afterwards, which is what makes the history you see trustworthy.

Watching for trouble

Automated monitoring runs continuously against transactions in flight. It looks for specific things: a payment stalled well past its normal time, a missing confirmation from a receiving bank, the same amount debited twice within a minute, and money moving on an account that has been restricted.

When it finds one it does not wait for you to notice. It flags the transaction, opens a support case with a reference, and puts it in front of a person. You see the same case, at the same time, in the app.

Cards

• ✓Freeze or unfreeze a card yourself, instantly, as many times as you like.
• ✓Cancel a lost card permanently and order a replacement.
• ✓Set limits on how a card can be used.

If money leaves your account without your authority

We refund it. Unless we can show you acted fraudulently or with gross negligence, an unauthorised payment is our loss, not yours. We refund first and investigate afterwards wherever the facts allow. You do not have to prove your innocence to get your money back.

Tell us at security@vaultly.app or through the app as soon as you notice. You will get a case reference and a named outcome.

What we are still building

Being straight about this matters more than sounding finished. Card tokenisation, encryption of stored data at rest, and automatic app lock on inactivity are on the roadmap and are not live yet. When they are, this page will say so and will date the change. We would rather tell you what we do not have than let you assume.

What you can do

• ✓We will never ask for your PIN, passcode or a one-time code. Anyone who does is not us, however convincing they sound.
• ✓Use a passcode you do not use anywhere else.
• ✓Turn on Face ID, so a stolen phone is not a stolen account.
• ✓Tell us the moment something looks wrong. Speed matters more than certainty, and we would much rather check a false alarm.

Reporting a vulnerability

If you have found a security flaw, we want to hear from you before anyone else does. Email security@vaultly.app with enough detail to reproduce it. We acknowledge within 2 business days, keep you updated, and will not pursue legal action against anyone who reports in good faith and gives us reasonable time to fix it.