How DeviceBound Works

Live device verification in ten steps. If it's not green, don't proceed.

1
A verification is requested
Someone needs to verify a person: before a meeting, at a door, before sharing something sensitive.
2
They enter the person's mobile number
The mobile number identifies who is being verified. Nothing is sent until the request is created.
3
DeviceBound sends a secure verification link
A one-time link is delivered by SMS or email, or shared in person as a QR code. It expires in 30 minutes.
4
The recipient opens the link on their phone
No app to install, no account to create. The link works in the browser they already have.
5
The phone checks it's them, locally
Face ID, fingerprint, or the phone's screen lock runs on the phone itself. Biometric data never leaves the device and is never sent to DeviceBound.
6
A cryptographic key pair is generated
The device creates a public/private key pair for this verification. The private key never leaves the user's device.
7
The response is tied to this one request
It carries a one-time challenge minted for this exact request, so it can't be reused for another one.
8
DeviceBound stores only public verification information
Status, timestamps, the DeviceBound ID, and the audit record. No secrets, no biometrics.
9
The requester's screen turns green
In real time, with no refresh. Red means not verified. Green means the holder of that mobile number completed a live device verification on their phone. It does not verify legal identity.
10
Every verification stands on its own
Each request gets its own record and DeviceBound ID, with the time it was completed.

Questions about the technology? See the Security page and Trust Center, or write to support@devicebound.us.