Security and trust
How we protect your money, your sign-in and your data.
Security at Fidorox is not a feature page. It is how the product is built: a passkey or an authenticator app beside every password, a record of every change, staff who see only what their job needs, and nothing on our site that reports on you to anyone.
Your money
Where your money will be held.
Fidorox is a financial technology company, not a bank. We build the app and the service; the regulated parts (holding your money, issuing cards, making payments) will be provided by our licensed partner, [Licensed partner] (to be confirmed).
When accounts open, the money in your Fidorox account will be held by [Licensed partner] (to be confirmed) and safeguarded: kept apart from the partner’s own money, so that it is returned to you first if the partner fails. Safeguarded money is not covered by a deposit guarantee scheme.
Your sign-in
Phishing-resistant from the first day.
Passkeys first
Besides your password, your account is secured with a passkey on your phone or computer, or an authenticator app, before your first session. A passkey only works on Fidorox, so a fake site cannot trick it out of you.
Recovery codes, shown once
You keep a set of single-use recovery codes, shown once and never again, for the day you lose every device.
Five minutes of quiet
A session ends after five minutes without activity, and none lasts longer than twelve hours. The app warns you before it signs you out.
Asked again when it matters
Changing your password or email address, adding or removing a passkey, making new recovery codes, downloading your data or closing your account asks for your passkey or authenticator app again, unless you confirmed it was you in the last five minutes. Adding a recipient and raising a limit will ask the same, when payments and cards open.
Passwords we refuse
A password found in a known data breach is refused at sign-up. We check it without sending it anywhere: only the first characters of its fingerprint leave our servers.
Every device and session
See where you are signed in, end any session, or sign out everywhere at once, from the app.
What you see
Your sessions, your email, your data.
Every device signed in to your account, an email when a new one signs in, and a copy of your data when you ask for it, up to five a day.
Your data
Private by design, not by policy alone.
No trackers, no analytics, no pixels
Fidorox has no third-party scripts, advertising pixels, chat widgets or analytics, on this site or in the app. That is why there is no cookie banner: the only cookies are the strictly necessary ones.
Encrypted, with secrets sealed again
Data is encrypted in transit and at rest; the most sensitive values, such as the keys behind your authenticator app and your passkeys, are sealed again inside the database.
Staff see only what their job needs
Our staff use a separate backoffice with its own sign-in and passkeys. Every time a person at Fidorox reads customer data, the access is recorded.
A trail that cannot be rewritten
Every sign-in and every change to an account is written to an append-only record that nobody, staff included, can edit or delete.
Watched by automated alarms.
How the service runs from launch.
- Monitoring
- Automated alarms watch the service and alert our team when something is wrong.
- Backups
- An encrypted copy of the database every night, kept in a second region too, and an encrypted copy outside our cloud provider every six hours. Every week a machine restores them, to prove they work.
- Changes
- Every change to the service passes our automated checks before it ships, and every release can be traced to the change that made it.
- What you see
- Every device signed in to your account, with a way to end any session; an email for every sign-in from a new device and every change to how you sign in; and a copy of your data to download.
Researchers
Found a vulnerability? Tell us.
Write to security@fidorox.com. We answer every report, fix what is real, and do not take legal action against research done in good faith under our policy.
Our disclosure policyQuestions
What is a passkey?
A passkey is a key your phone or computer keeps for you, unlocked with your face, your fingerprint or your device’s PIN. It only works on fidorox.com and our app, so a fake site cannot trick you into giving it away, and there is nothing for anyone to steal from us.
What if I lose my phone?
Sign in on another device with a second passkey, your authenticator app or one of your recovery codes, then remove the lost phone from your account. Without any of those, our support team can help once we have checked it is really you.
Why am I signed out after five minutes?
The rules for payment accounts ask that a session ends after at most five minutes without activity, so an unattended screen cannot be used by someone else. The app warns you before it signs you out.
Will Fidorox ever ask for my password or codes?
Never. Nobody at Fidorox will ask for your password, a code we sent you, a recovery code or to approve a sign-in, by phone, email or message. If someone does, it is not us: end the conversation and write to us.