FAQ
Questions people actually ask
Including the awkward ones.
Does REAL AUTH store my fingerprint or my face?
No. Never. Biometric verification happens inside your device's operating system and unlocks a key stored there. REAL AUTH receives a signature produced by that key. There is no biometric data in the system, so there is none to lose.
What happens if I lose my phone?
Sign in with another registered passkey or device and revoke the lost one, which takes effect immediately. This is why the interface pushes you to register a second authenticator. If you only ever had one and no password, recovery is deliberately slow and involves additional checks — an account that is easy to recover is an account that is easy to steal.
Can REAL AUTH stop phishing?
It removes the value of a phished password, because a passkey will not sign for a look-alike domain. It does not detect phishing, filter your mail, or warn you that a site is fake, and it cannot help against an organisation that has not integrated it.
Can it detect deepfakes?
No, and it does not try. It sidesteps the question by verifying whether the authorised person approved the request, rather than whether a recording is genuine.
Is a passkey safer than a password plus SMS?
For the common attacks, yes. SMS codes can be phished in real time, intercepted, or obtained through a SIM swap. A passkey cannot be typed into the wrong site, because it refuses to work on the wrong origin.
Do I have to install an app?
No. Passkeys work in the browser on Windows, macOS, iOS, Android and with hardware security keys. A REAL AUTH mobile authenticator is being built for cross-device approvals, but sign-in does not depend on it.
What does it cost?
Personal accounts are free. Businesses pay for platform access, production domains, authentication volume and advanced verification. Plan pricing is published on the pricing page once configured; until then, enterprise pricing is by conversation rather than by a number invented for a web page.
Where is my data stored?
On this platform's infrastructure, currently hosted in the United Kingdom. Identity, authentication, billing and audit data are stored separately rather than pooled into a single profile, and retention is bounded per category.
Can I delete my account?
Yes. Account data is deleted on request, with the exception of records we are required to retain — security and audit logs relevant to fraud investigation, and billing records with a statutory retention period. The privacy page states exactly which.
Is REAL AUTH patented?
No. Some concepts may be reviewed for protection in future, and until any protection actually exists no claim of it will be made here.
Is any of this blockchain-based?
No, and it works entirely without one. There is an interface for an optional future trust registry, but no personal data, key material or login history would ever be published to a public chain. Using a blockchain for marketing reasons would be a red flag.
What if REAL AUTH goes down?
Then applications that depend on it for sign-in cannot verify during the outage, which is a real dependency you should weigh. The status page reports what can actually be measured, and integrating applications should decide in advance what they do when verification is unavailable.
Still unsure?
The sandbox answers most questions faster than reading about it.