Security

Passkey (Biometric)

Your passkey uses your device's built-in security — Face ID, fingerprint, or device PIN. It is required for all digital currency transactions and high-value actions. The passkey signs every transaction directly on your device. Your funds cannot be moved without your biometric approval. Passkeys are device-specific and cannot be phished or stolen from a server.

Arcle PIN

Your 4-digit Arcle PIN is used for local currency transactions and app access. It is verified server-side and provides a convenient second layer of security for everyday payments. Never share your PIN with anyone.

Confirmation Flow

Before any financial action executes, Arcle shows you a clear summary of exactly what will happen — the amount, the recipient, and any relevant details. You have the opportunity to review and either confirm or cancel. Nothing happens without your explicit approval.

Scam Detection

Arcle analyses each transaction for signs of fraud or social engineering. If a request seems suspicious — unusual recipient, high amount, or known scam patterns — Arcle warns you before you confirm. This runs on every transaction, every time.

Address Validation

When you send to a wallet address, Arcle validates the address format and checks it against known addresses before executing. This prevents mistakes from typos or incomplete addresses.

Wallet Recovery

There is no seed phrase and no recovery key for you to write down. If you lose your device, you recover with two factors you already have: a one-time code sent to your email (something you have) and your Arcle PIN (something you know). You create a fresh passkey on the new device, and your wallet is handed over to it — same address, same balance, same history.

Your recovery key is generated and encrypted on our servers (AES-256-GCM, protected by your PIN plus a server-side secret) and is decrypted only during recovery — it never enters your browser. The recovery signer is deliberately limited: it can only hand your wallet to a new passkey — it can never move your money. Even if it were misused, your funds cannot be spent without your biometric.

WhatsApp Safety

The Arcle WhatsApp bot never moves money. It answers questions and prepares payments, then hands you a short-lived, signed link to confirm in the app — your passkey or PIN never travels through WhatsApp. Linking your number requires a code emailed to your account address, so owning the phone alone is not enough. You can disconnect anytime from WhatsApp or from Settings, which also clears your chat history there.