Security
Security and trust, built into the foundation.
Because we build and run our own infrastructure, security is not a feature we add later, it is how the whole thing is designed. Here is how we protect your money and your identity, and the two promises we hold ourselves to.
Two promises
How to know it is really us.
Phishing works by pretending to be someone you trust. These two promises never change, so you always know when you are truly on Bolrach.
Bolrach Pay financial actions take place only on bolrachpay.com or a genuine subdomain ending in .bolrachpay.com.
Bolrach products sign in with Authvio. Authentication and identity security take place only on authvio.com or a genuine subdomain ending in .authvio.com.
How we build
Security principles we don’t bend.
Independent infrastructure
We run our own systems, so security is designed in from the foundation up, not bolted onto someone else’s stack.
Phishing-resistant identity
Sign in with Authvio using passkeys and device-bound verification. Money movement always requires fresh, phishing-resistant confirmation, never SMS codes.
Privacy by design
No inbox scanning, no selling your data. Encryption in transit and at rest, least-privilege access, and data you can export at any time.
Separate authority for money
Bolrach Pay keeps its own financial session, limits, and approvals. A valid login never, by itself, moves your money.
Responsible disclosure
Found something? Tell us.
We welcome reports from security researchers. Our security contact details and policy are published at a standard, machine-readable location.
Read security.txtReport a vulnerability
Email [email protected] with details and steps to reproduce. We acknowledge reports and work with you on a coordinated fix.
Built on a foundation you can trust.
Explore the products, or get in touch with our team.