How Auro really works.

Who holds the key

Each account has its own vault address on Solana. Auro's servers hold that vault's signing key, one key per account, and use it only after all seven checks pass.

This is not a smart contract. Deploying one costs fees that would land on you, so the rules run on our servers instead. Every move is still on-chain for anyone to check. It also means you trust Auro to enforce the rules honestly. Read the risks.

The seven checks

1. Start. Pick the token, recipient and amount. Auro simulates the send and shows the fee.
2. Face ID. Your face opens a passkey on your phone.
3. PIN. A second secret that lives only in your head.
4. Intent. You read what will happen and accept it.
5. Trusted phone. This phone's own key signs the request.
6. Final review. Same address, same amount, checked again with a short check code.
7. Password. The last word is yours.

Each check is verified on our server against one transaction fingerprint. Change the address or amount after any step and the earlier checks no longer match, so the send stops.

The trusted phone

One phone is trusted at a time. It makes a device key that never leaves that phone's browser storage, and a passkey for Face ID. A new device that signs in with your password sees a read-only safe until the trusted phone approves it.

Recovery

If you lose the trusted phone, the 24 words do not spend anything. They only start a 72-hour clock to make a new phone the trusted one. Your old phone shows it in the app right away and can cancel at any time.

Emergency lock

One switch stops all outgoing sends and cancels anything waiting. Unlocking needs your trusted phone, your PIN and your password, and takes effect after 1 hour.

Safeguards

You can set a daily limit, a cooldown for new addresses and a delay for large sends. Making a rule tighter applies now. Making it looser waits 24 hours, so a thief cannot switch your protection off.

What we can't protect against

A phone that is already compromised, someone talking you into a send, bugs in our code, and losing your phone and your words together. Plain detail on the risks page.

What comes later

We plan to move the vault into an on-chain program so the rules no longer depend on our servers. That is a plan, not a promise, and it would be announced before anything changes for you.