How we protect the thing we sell

Keys stay on the device

When a user enrols, a key pair is generated inside the phone’s secure hardware. The private key never leaves the device, so it cannot be copied, exported, SIM-swapped or replayed. Each enrolled device is identified by its own X.509 certificate.

An approval is a digital signature over the request, timestamped and certificate-backed. Your systems verify it cryptographically and keep it as audit evidence. Notakey never stores user data centrally.

A push is only a doorbell

The push notification carries no decision. The app fetches the approval card over HTTPS from the service domain it was enrolled against, and the server can be configured to show the requesting IP address, service name or URL on that card. Requests expire, and a built-in limiter caps how often they can be triggered.

That is what defeats push-bombing: every request shows what is being approved, and a prompt nobody started is easy to decline.

What we do not claim

Phone approval removes the password as a login and the SMS code as a second factor. It does not by itself stop an adversary-in-the-middle relay, where a proxy forwards a real login and the user approves their own session on the wrong site. Showing where the request came from on the approval card makes such a proxy visible to a user who looks; it does not make the attack impossible.

CISA counts only FIDO/WebAuthn and PKI-based methods as phishing-resistant, and push approval is not on that list. We say so on our own pages rather than borrow the label.

Runs where your data is

The Notakey appliance runs as a virtual machine on your own infrastructure or in our cloud. With the on-premise appliance, the authentication server and its data run on your own infrastructure, and you control updates and redundancy. Users enrol against the directory you already run (Active Directory, LDAP or RADIUS), and the appliance speaks RADIUS, SAML and OAuth, so your VPN and applications keep working unchanged.

Compliance

The platform is designed for strong customer authentication under PSD2, for advanced and qualified electronic signatures under eIDAS, and for data minimisation under GDPR, where the user’s key material stays on the user’s device. Our data processing agreement is published on this site.

This website

This site is static HTML with no content management system, so there is no admin login to attack and no CMS to patch. The contact form posts to a single serverless function. Fonts are self-hosted, and analytics are cookieless and anonymous, which is why there is no consent banner. The privacy policy describes exactly what is collected.