Tamper-Evident Audit Trails
Every action is cryptographically signed
and permanently recorded.
SECURE • VERIFY • SIGN • TRUST
Verifiable Approvals
for a Safer Digital World
TapSign moves sensitive decisions to the device you already trust.
Every approval is cryptographically signed, tamper-evident and
recorded in a complete audit trail.
- ✓Stronger security
- ✓Full audit trail
- ✓Simple integration
Verified Device Identity
Approvals only from enrolled, trusted
devices with biometrics.
Policy & Access Controls
Set exactly what needs approval and
who can authorise it.
Compliance Ready
Export verifiable records for audit,
regulatory and internal review.
Real people. Real decisions.
Proof of who approved what, on every action that matters.
1
Tap to approve, with your fingerprint or face
2
Phone apps: iPhone and Android
100%
Of approvals signed by a key that never leaves the phone
0
Codes sent by text to approve, so nothing to phish
TapSign and MFA, side by side
MFA checks who signs in. TapSign checks what happens next.
Many attacks now begin after sign-in: a stolen session, a hijacked inbox, a convincing call. With TapSign, the actions that matter wait for the right person to approve on their own phone.
Optional
Use it as your sign-in or MFA
Sign in with a tap on your phone instead of passwords and codes, or keep the sign-in you already have.
The core
Protect what happens after sign-in
You choose the actions that matter: payments, bank details, exports, new administrators, sensitive email. Each one waits for a fresh approval on the right phone.
What happensTypical MFATapSign
Someone phishes a passwordA fake sign-in page asks for the code too, and passes it on within seconds.There is no code to pass on. Approval needs the person’s phone and their face or fingerprint.
A look-alike Microsoft page collects a password and a six-digit code and replays both to the real site. With TapSign there is nothing to type: the approval is made on the phone itself, and the card shows what is being approved, so an unexpected request is easy to refuse.
Someone steals a signed-in sessionMFA is skipped. The stolen session is already past sign-in and can do what the user can.A session is not an approval. Protected actions still wait for the person’s phone.
Malware copies a browser’s session and an attacker opens the account from another country. They try to change a supplier’s bank details. TapSign sends the request to the real person’s phone, and nothing changes unless they approve.
Signing in with a passkeyIt stays on one computer or in a cloud account. On another computer you scan a QR code, and a stolen session skips it.TapSign Passkey goes with you on your phone, with no QR. Never synced or copied, and a stolen session opens nothing on another computer.
An ordinary passkey is saved on one computer or in a cloud account, and a computer without it asks you to scan a QR code with your phone. TapSign Passkey stays in your phone’s security chip and is never synced or copied. On any computer, type your email, check that your phone and your screen show the same number, and approve with your face or fingerprint. You can choose which computers may sign in; any other is refused before a request reaches your phone. The session that follows belongs to that one browser and each request works once, so a stolen session or cookie opens nothing on another computer. TapSign Passkey is how you sign in to TapSign, on every plan. It saves typing a password: sign in with a password and your phone still approves.
Prompt after prompt, until someone gives inA plain Approve or Deny, repeated until someone taps yes to make it stop.Each card says what is being asked. One refusal stops the request.
For group approvals the person named as asking confirms on their own phone first, so a request they never made is refused at the start and never reaches their colleagues.
One person acting aloneOne person, one approval.Require two or more named people. Any one of them can stop it.
A payment over your limit can need the finance manager and a director. A single insider, or a single stolen phone, is not enough.
A phone is lost or stolenCodes can show on the lock screen, and a phone number can be moved to a new SIM.The phone alone approves nothing. Adding a new face or fingerprint destroys its TapSign key.
Every approval needs the owner’s face or fingerprint. If someone adds their own face or finger to the phone, the TapSign key is wiped, and your administrator removes the phone from the company.
A deepfake call from “the CFO”Not involved: a real employee, already signed in, makes the transfer.The transfer still waits for the real approvers’ phones.
A cloned voice can convince a person on a call. It cannot reach the sensor in anyone’s phone, so the payment waits until the named approvers approve on their own devices.
Someone leaves the companyAccess ends when every account and every device is found and switched off.Remove them, and their phone stops counting at once, even for requests already waiting.
An approval from a phone whose owner has been removed is not counted, even if it arrives after the request was sent.
Proving what happenedA sign-in log: who got in, and when.A record of every approval and refusal: who, which phone, what, when.
Refused requests are kept too, with the phone and the time that refused them, so an attempt that failed still leaves a trail.
Tap a row for an example.
Typical MFA means a code by text or app, a push prompt, or an ordinary passkey at sign-in. TapSign protects the actions you put behind it; anything you leave unprotected works as it does today.
TRUST
Our products
Every TapSign product, on the same phone.
One approval across every surface. Each product keeps its own integration path while sharing the same enrolled phone and the same audit trail.
Universal Web SDK
Protect website login, step-up approval and browser sessions even if a password leaks.
Learn more→
Mobile SDKs
Bring TapSign approval into iOS and Android apps, signed by the secure chip in each phone.
Learn more→
React & Next.js
Hooks and components that add phone approval to any React or Next.js app.
Learn more→
Guardian
Protect destructive admin or ops actions on the server side, before the code path executes.
Learn more→
Developer Access
Developers push code to GitHub and GitLab without ever holding your SSH key. Each push waits for their own phone.
Learn more→
Desktop Vault
Protect desktop vault access, workstation unlock and sensitive tools on Windows and macOS.
Learn more→
TapSign Mail
Require a physical tap before sensitive emails send, and show recipients a verified signature badge.
Learn more→
Commerce & CMS
Protect WordPress and Shopify admin login, payouts, exports and store settings.
Learn more→
Agent Control HRM
Let AI agents and staff work, but block dangerous actions until a real person approves.
Learn more→
Featured
See all products
Protect the systems your company runs on.
Code and deploys
Protect GitHub and GitLab pushes, CI/CD, deployments and infrastructure operations.
High-risk commands
Require phone confirmation before high-risk commands, secret access or deploys.
Leaked credentials
A leaked password, session or API token is not enough on its own to run a protected action.
Privileged actions
Approve privileged, destructive and root-equivalent actions before they execute.
AI and cloud keys
Keep upstream AI and cloud credentials server-side, behind policy.
A record you can check
Every approval is signed on the enrolled device and can be verified afterwards.
Everything behind one enrolled phone
Three steps. One phone. One controlled approval flow.
Approve a login, a payout, a deploy or a destructive admin action from the phone you already carry: the same enrolled device, whatever the surface.
No shared secret to leak, no session to replay, no password that is enough on its own.
Why we built TapSign
High-risk actions stay behind phone approval.
Too much still depends on a password and a session cookie. Both can be stolen, and neither asks the person. TapSign moves the final decision onto a device an attacker does not hold.
Website login, admin actions, desktop unlock, terminal commands and signed email: one approval contract, one enrolled phone, one audit trail.
Our products
One approval layer across every surface you already run.
Every service runs on one TapSign account. Hover a card to see its identity take over.
Developer Access
Developers push code to GitHub and GitLab without ever holding your SSH key. Each push waits for their own phone, so a stolen laptop is not enough.
Learn more→
Universal Web SDK
Protect website login, step-up approval and browser sessions even if a password leaks.
Learn more→
Mobile SDKs
Bring TapSign approval into iOS and Android apps, signed by the secure chip in each phone.
Learn more→
React & Next.js
Hooks and components that add phone approval to any React or Next.js app.
Learn more→
Protected actions
A dangerous step waits until the right people approve on their own phones, the asker first.
Learn more→
Desktop Vault
Protect desktop vault access, workstation unlock and sensitive tools on Windows and macOS.
Learn more→
TapSign Mail
Sign every important email with a tap on your phone. Recipients see a verified badge, so a fake or altered email is caught before anyone acts.
Learn more→
Commerce & CMS
Protect WordPress and Shopify admin login, payouts, exports and store settings.
Learn more→
Agent Control HRM
Let AI agents and staff work, but block dangerous actions until a real person approves.
Learn more→
Developer Access
Your developers ship code. Your SSH key never reaches their laptops.
Invite a developer by email. From then on, their pushes to GitHub and GitLab wait for an approval on their own phone. Your SSH key is created inside TapSign and is never shown or sent to anyone: not you, not your developers, not TapSign staff. There is no copy to leak, steal or hand over.
No key on the laptop
No SSH key file ever sits on a developer's machine, so a stolen laptop, a backup or a leaked folder holds nothing to use.
Every push asks their phone
Each push waits for the developer to approve with face or fingerprint. A stolen laptop or password is not enough.
Remove access at once
Remove a developer in your TapSign portal and their next push is refused.
Included on every plan: Free covers 2 developers and 2 repositories. See pricing
Service
One platform for logins, approvals and protected actions.
Whichever surface you are protecting, TapSign gives you the same enrolled phone, the same approval contract and the same audit trail.
Ecommerce
Require a tap before a sensitive email sends.
Invoicing
Recipients see a verified signature badge on what arrives.
Signed email
Every signature is verifiable against the sending domain.
Already running TapSign
Where TapSign sits in your stack.
Websites, admin panels, desktops, terminals and mailboxes: wherever a sensitive action happens, the decision moves to the enrolled phone.
Website and app login
A Scan & Pay card on the counter is all it takes - no terminal to rent, no card machine to maintain.
Admin and ops actions
Destructive backend actions wait for approval before the code path executes.
Infrastructure and CI/CD
Bookings, deposits and final payment - all through the same account, with a record of each one.
Pricing
Clear pricing, no surprises.
Monthly or annual: annual is ten months for twelve. Desktop Vault from $19, WordPress and Shopify from $10. Enterprise and on-prem are quoted; talk to us. Buying takes you to the workspace sign-in, where the plan is activated against your account.
Free
$0
no card required
Developers and small projects.
- 500 verifications per month
- 1 app or site
- 1 registered phone
- 2 developers with Developer Access
- TapSign badge required
Starter
$49
per month + usage
Solo builders and small sites on a budget.
- 80,000 verifications per month (10,000 users)
- 2 custom domains
- 10 staff, 1 company admin
- 10 developers, 10 protected repositories
- Signed email included: 10 sending addresses, no charge per email
- 50,000 signed automated emails a month: receipts, orders, resets
- Protected actions: phone approval before dangerous steps
Growth
$299
per month + usage · $2,990/year
SDK teams and production rollouts.
- Verifications beyond the included tier meter from $0.008, falling to $0.002 at scale
- 25 staff, 3 company admins, 10 custom domains
- Signed email included: 25 sending addresses, no charge per email
- 500,000 signed automated emails a month
- Hosted Stripe checkout
- Priority support and billing exports
- Two-person approval on one protected action
- 25 developers, unlimited repositories
Enterprise
Talk to us
Volume, staff rollout and governed approvals are quoted against your actual usage, not a list price.
- Staff enrollment and device registration
- Signed email for all your staff, up to 10,000 sending addresses
- 5,000,000 signed automated emails a month, more by contract
- Unlimited developers and repositories
- Approval policies and governed actions
- Audit trail and recovery
- Volume verification pricing
- Integration and rollout support
On-premise
Talk to us
Isolated or on-prem delivery for regulated buyers who need the control path inside their own environment.
- Dedicated or on-prem deployment
- Private control paths
- No monthly cap on signed automated email
- Commercial and security review before launch
- Ministry and regulated-buyer support
- Negotiated volume and term
Compare every plan.
What each plan includes, and where it stops. Enterprise and on-prem are quoted against your actual volume rather than a list price.
| Free | Starter | Growth | Enterprise | |
|---|---|---|---|---|
| Users and volume | ||||
| Monthly active users | 1,000 | 10,000 | 90,000 | Negotiated |
| Verifications per month | Up to 500 | Up to 80,000 | Up to 720,000 | Unlimited |
| Surprise overage bill | No, capped | No, capped | No, capped | No, contracted |
| Surfaces | ||||
| Apps or sites | 1 | Unlimited | Unlimited | Unlimited |
| Staff with a TapSign phone | Owner only | 10 | 25 | Up to 10,000 |
| Company admins | ✕ | 1 | 3 | 5 |
| Developers (Developer Access) | 2 | 10 | 25 | Unlimited |
| Protected repositories | 2 | 10 | Unlimited | Unlimited |
| Custom domains | ✕ | 2 | 10 | Up to 250 |
| Approval features | ||||
| Website and app login approval | ✓ | ✓ | ✓ | ✓ |
| Protected actions (phone approval before dangerous steps) | ✕ | Up to 3 | Up to 10 | Up to 200 |
| Two-person approval | ✕ | ✕ | On 1 action | On every action, up to 10 approvers |
| AI agent protection | ✕ | ✕ | ✕ | Included |
| Signed email (TapSign Mail) | Receive-verify | Send and sign | Send and sign | Send and sign |
| Addresses that can send signed email | ✕ | 10 | 25 | Up to 10,000 |
| Charge per signed email or per signer | No sending | None, included | None, included | None, included |
| Signed automated email per month (receipts, orders, marketing) | ✕ | 50,000 | 500,000 | 5,000,000, more by contract |
| Desktop vault | ✕ | Add-on | Add-on | Included |
| Operations | ||||
| Audit trail | ✓ | ✓ | ✓ | ✓ with export |
| TapSign badge required | Yes | No | No | No |
| Support | Community | Standard | Priority | Named contact |
| Deployment | Shared cloud | Shared cloud | Shared cloud | Dedicated or on-prem |
Frequently asked questions
Here are some of the questions people frequently ask.
What is TapSign?
TapSign asks the right person to approve sensitive actions on their own phone, with their face or fingerprint. You choose which actions: payments, bank detail changes, exports, new administrators, sensitive email. Every approval and refusal is recorded.
Does TapSign replace our MFA or Microsoft sign-in?
No. Sign-in can stay exactly as it is, and TapSign adds a check at the actions that matter, after sign-in. If you want, TapSign can also be your sign-in: a tap on the phone instead of passwords and codes.
How is it different from Microsoft Authenticator, Duo or Okta Verify?
Those check the person once, at sign-in, and after that the session is trusted for everything. TapSign checks at the action: the phone shows what is being approved, and the approval is signed inside the phone’s security chip. A stolen session gets past sign-in and still cannot complete a TapSign-protected action.
What is TapSign Passkey?
The way you sign in to TapSign, built in and included on every plan: no password and no QR code. Type your email, check that your phone and your screen show the same number, and approve with your face or fingerprint. The key stays in your phone’s security chip and is never synced or copied. You can choose which computers may sign in; any other computer is refused before a request even reaches your phone. After you sign in, the session belongs to that one browser: a stolen session or cookie does not work on any other computer, and each request works once, so a copied one cannot be sent again. TapSign Passkey only saves you typing a password; it is not what keeps you safe. Sign in with your password and your phone still has to approve, so a stolen password alone opens nothing.
How do I sign in on a new computer when sign-in is restricted?
Turn the restriction off from the TapSign app on your phone, sign in on the new computer, add it to your allowed computers, then turn the restriction on again. Each change needs your face or fingerprint.
We already use passkeys or security keys. Do we still need TapSign?
Passkeys and security keys are good at proving who signs in. They do not show what a payment or a change is, and they cannot require a second person, so keep them for your other sign-ins and use TapSign for the actions. To sign in to TapSign itself you need neither: TapSign Passkey is built in.
What if someone steals a password or a signed-in session?
It depends whose sign-in it is.
Your own sign-in (your password, single sign-on or session, not TapSign): a thief may get into the account, as they could today. Every action you protect with TapSign still waits for a fresh approval on the real person’s phone, which they do not have.
TapSign as your sign-in: a stolen password is not enough, because signing in needs the person’s phone and their face or fingerprint. Each approval works once, for that one sign-in, so it cannot be used again.
TapSign’s own sessions, such as your TapSign admin portal: the session is tied to the browser that signed in, so a copied session or cookie does not work anywhere else.
Can someone who is already inside switch TapSign off?
No. Changing which actions are protected, and who must approve them, itself needs the company owner’s approval on their phone.
What about prompt after prompt, until someone taps yes?
Each card shows what is being asked, so a request nobody made is easy to spot, and one refusal stops it. For group approvals the person named as asking confirms first, so a request they never made never reaches their colleagues.
Can our administrators, or TapSign staff, approve on someone’s behalf?
No. Each approval is a signature made on the named person’s own enrolled phone, behind their face or fingerprint. Administrators can remove a phone; they cannot approve with it.
Do staff need new phones?
No. The TapSign app runs on current iPhones and Android phones with a face or fingerprint sensor, company or personal.
What if a phone is lost or stolen?
The phone alone approves nothing: every approval needs the owner’s face or fingerprint. If anyone adds a new face or fingerprint to the phone, its TapSign key is destroyed. Your administrator removes the lost phone from the company.
Can a deepfake approve?
A deepfake video or a cloned voice can fool a person on a call. It cannot reach the sensor in the phone, and the key that approves never leaves the phone’s security chip. For the actions where that risk matters, require two people.
Can banks and government services use TapSign against deepfakes?
Yes, for the actions that matter. A bank or a government service can require that a payment, an account change or a sign-in is approved on the person’s own enrolled phone, with their face or fingerprint. A cloned voice or a fake video can persuade someone on a call, but it cannot produce that approval.
What if someone leaves the company?
Remove them, and their phone stops counting at once, even for requests already waiting.
What happens when a request is refused?
Nothing executes. The request is recorded as refused, with the phone and the time that refused it.
Who decides which actions need approval?
You do. You choose which actions require approval and who must approve them. Everything else works as before.
Do approvals ever use text-message codes?
No. Approvals happen in the TapSign app, so there is no code to intercept or pass on.
Does it work with email?
Yes. In Gmail and Outlook on the web, the TapSign browser extension adds a “Signed by” mark to mail the sender approved on their phone, so staff and clients can tell a real instruction from one sent by someone else.
What is TapSign Mail?
TapSign Mail lets the people who receive your company’s email tell a real message from a fake one. An important email, such as a payment instruction, is signed personally: the sender approves that exact email on their phone and it arrives marked as signed by them. Internal staff mail and automated mail can carry your company’s verified mark without a tap.
What do the marks on an email mean?
Signed by a person: the named sender approved this exact email on their own phone. Verified domain, staff: the email really came from your company’s verified domain, sent by staff your company chose; it proves the company, not which person (shown in Gmail with the TapSign extension). Automated: a receipt, invoice or reset email signed by your company’s approved sending server. No mark means no TapSign proof, so treat any instruction in it with care.
When should an email be signed personally?
Whenever acting on it matters: payment instructions, bank detail changes, contracts, sharing client files. Recipients then know the named person approved that exact email, not just that it came from your domain.
Can our automated emails, like receipts and password resets, be marked too?
Yes. Your sending server signs each automated email through TapSign, and only senders you approve on your phone can do it, so a look-alike receipt or reset email from someone else carries no mark.
Can I check an email on my phone when I am away from my laptop?
Yes. Add your email address in the TapSign app’s Verify Inbox and the signed emails sent to you appear there. Tap Verify to see whether an email was signed by the named person or by your company’s approved automated sender; one that fails the check is flagged.
Can it run on our own servers?
Yes. Use TapSign cloud, or the same product on your own infrastructure.
Before we connect anything, can you check our own systems?
Yes. Our developer scanner runs on your own machine and uploads nothing. It shows where an action could skip the approval, and flags known weaknesses and exposed secrets in your code. It checks code, not your live network.
How much does it cost?
There is a free plan to start. Paid plans are on the Pricing page; enterprise and on-premises are quoted for your volume.
How is signed email charged? Is it per person?
Signed email is included in the Starter, Growth and Enterprise plans. There is no charge per signed email and no extra charge per person, and signing does not use up your monthly verifications. Everyone who signs uses the TapSign app on their own phone, and your plan sets how many: Starter has 10 staff and 10 sending addresses, Growth 25 and 25, Enterprise up to 10,000. Need more people? Move up a plan. The Free plan can check signed email but cannot send it, and checking a signed email you receive is free on every plan.
What about receipts, order emails and marketing email?
Email your own server sends automatically, such as receipts, order confirmations, password resets and marketing, carries your company’s verified TapSign mark. Each plan includes a monthly amount: Starter 50,000, Growth 500,000, Enterprise 5,000,000 or more by contract, and on-premise has no cap. There is no charge per email. If you reach the amount, your email still goes out, without the mark, until the 1st of the next month or an upgrade. The Free plan does not include it.
How do we get started?
Book a demo, or start free: install the TapSign app and scan your workspace QR code to enrol the phone that will approve.
Company
Real people. Real relationships.
TapSign exists so that a stolen password, session or API token is not enough to act. The decision belongs on a device the attacker does not hold.
Leadership
Security engineers, product people and support staff building one approval layer.
Press Release
Announcements, partnerships and launch coverage.
Legal Notice
Terms, privacy and cookie policies in one place.
Who we are
Experience the power of us.
TapSign is on a mission to make every important approval provable. Founded by software and security specialists, we build tools that put the final decision in the hands of the right person, on a device only they hold.
Serious security that stays simple to adopt: a documented contract, an enrolled phone, and a decision a person actually makes.
What we stand on
Built on three principles.
Everything we ship has to serve at least one of them.
⇄
Hardware-backed approval
A faster way to send, receive and pay. No handling physical cash, no worrying about fake currency, and real information the moment it matters - all from your phone.
↑
Growth for business
Security should help a business move faster, not slow it down. TapSign adds to the tools a team already uses, with no platform rebuild.
◎
Privacy by design
TapSign keeps only what it needs to prove an approval. Signing keys stay in the phone and never leave it.
Our vision
Technology should serve people.
We are working towards a posture where high-risk actions are never approved by a credential alone, and where the person, not the session, makes the final call.
Passwords leak, one-time codes get phished and sessions get stolen. We believe the person who owns an action should be the one who approves it, on a device only they hold, with a record anyone can check afterwards.
Our culture
More than a signature. A promise.
TapSign is one approval layer for sign-ins, payments, email, documents and admin actions, built for teams that need proof of who approved what.
✦
Innovation
We push at the edges of what security technology can do, because the attacks teams face today are not the ones older tools were built for.
✳
Collaboration
Different perspectives and real teamwork produce better systems than any one specialist working alone.
⛨
Security
We protect our customers’ data with the seriousness a bank is held to.
◉
Global impact
We build for teams everywhere, from a two-person startup to a regulated enterprise.
⚡
Performance
Systems that stay fast and stay up, on the networks and handsets people actually have.
♥
Customer focus
Our customers come before our products and before profit. Every feature is designed from their side of the counter.
The people
The team building TapSign.
The people who build and support TapSign.
Leadership
Setting the direction and holding the licence obligations.
Device trust
The people who onboard workspaces and support rollouts.
Engineering
Enrollment, proofs and the TapSign approval layer.
Support & compliance
Security reviews, compliance and the people who answer when you call.
Our team
Talent wins games. Teamwork wins championships.
Engineers, security specialists and product people in one team: mobile and frontend through backend architecture, security governance, databases, AI and analytics.
⌨
Development
React, Next.js, Node.js, NestJS and TypeScript, building applications that stay responsive under real load.
⛨
Security & governance
Advanced authentication through TapSign, our approval layer: a payment moves only after the customer confirms it on their own device. Access control, audit trails and key custody are designed in, not bolted on.
⌗
Database engineering
PostgreSQL and modern data practice, tuned for correctness first: an approval must never be counted twice.
▢
Mobile
Cross-platform applications built for the handsets and networks our customers actually carry.
◈
AI & machine learning
Risk scoring, anomaly detection and the checks behind device trust decisions.
◫
Data & analytics
Reporting teams can act on: approvals, refusals and device activity, with a full audit trail.
Our stack
What we build with.
Front to back, and the infrastructure underneath. Chosen for what they let us guarantee, not for what looks modern on a slide.
Front end
ReactNext.jsTypeScriptJavaScriptHTML5CSS3Tailwind
Mobile
FlutterDartReact NativeAndroidiOS
Back end
NestJSNode.jsTypeScriptJavaPythonRESTGraphQLWebSockets
Data
PostgreSQLPrismaRedisCloudflare D1Data warehousingAnalytics pipelines
Cloud & infrastructure
Cloudflare WorkersAWSGoogle CloudDockerKubernetesCI/CDCloudflare R2AWS S3
Security
TapSign approvalJWT & OAuthCASL access controlEncryption at restAudit loggingPenetration testing
AI & intelligence
Machine learningFraud detectionRisk scoringAnomaly detectionPython / ML tooling
Observability
PrometheusGrafanaSentryStructured logging
Trusted identity
Your next chapter starts here.
Opening a TapSign workspace takes minutes: enroll a phone, connect your first app, and every sensitive action waits for a real person to approve it.
Simple, secure, and built for the audits and obligations regulated teams face.
Inside TapSign
Built for teams that cannot afford to be wrong.
We build security tooling, and we use it ourselves. The same approval layer that protects our customers protects our own deployments and admin actions.
That is why the product is shaped the way it is: it has to work on the handsets people actually carry, on the networks they actually have.
How can we help?
Search the help centre, open a ticket, or ask the community.
Resolution Centre
See the next step for your case.
Community
Find answers or join the conversation.
Ticket Support
Enterprise customers can raise a ticket for faster support.
Frequently asked questions
Here are some of the questions people frequently ask.
What is TapSign?
TapSign asks the right person to approve sensitive actions on their own phone, with their face or fingerprint. You choose which actions: payments, bank detail changes, exports, new administrators, sensitive email. Every approval and refusal is recorded.
Does TapSign replace our MFA or Microsoft sign-in?
No. Sign-in can stay exactly as it is, and TapSign adds a check at the actions that matter, after sign-in. If you want, TapSign can also be your sign-in: a tap on the phone instead of passwords and codes.
How is it different from Microsoft Authenticator, Duo or Okta Verify?
Those check the person once, at sign-in, and after that the session is trusted for everything. TapSign checks at the action: the phone shows what is being approved, and the approval is signed inside the phone’s security chip. A stolen session gets past sign-in and still cannot complete a TapSign-protected action.
What is TapSign Passkey?
The way you sign in to TapSign, built in and included on every plan: no password and no QR code. Type your email, check that your phone and your screen show the same number, and approve with your face or fingerprint. The key stays in your phone’s security chip and is never synced or copied. You can choose which computers may sign in; any other computer is refused before a request even reaches your phone. After you sign in, the session belongs to that one browser: a stolen session or cookie does not work on any other computer, and each request works once, so a copied one cannot be sent again. TapSign Passkey only saves you typing a password; it is not what keeps you safe. Sign in with your password and your phone still has to approve, so a stolen password alone opens nothing.
How do I sign in on a new computer when sign-in is restricted?
Turn the restriction off from the TapSign app on your phone, sign in on the new computer, add it to your allowed computers, then turn the restriction on again. Each change needs your face or fingerprint.
We already use passkeys or security keys. Do we still need TapSign?
Passkeys and security keys are good at proving who signs in. They do not show what a payment or a change is, and they cannot require a second person, so keep them for your other sign-ins and use TapSign for the actions. To sign in to TapSign itself you need neither: TapSign Passkey is built in.
What if someone steals a password or a signed-in session?
It depends whose sign-in it is.
Your own sign-in (your password, single sign-on or session, not TapSign): a thief may get into the account, as they could today. Every action you protect with TapSign still waits for a fresh approval on the real person’s phone, which they do not have.
TapSign as your sign-in: a stolen password is not enough, because signing in needs the person’s phone and their face or fingerprint. Each approval works once, for that one sign-in, so it cannot be used again.
TapSign’s own sessions, such as your TapSign admin portal: the session is tied to the browser that signed in, so a copied session or cookie does not work anywhere else.
Can someone who is already inside switch TapSign off?
No. Changing which actions are protected, and who must approve them, itself needs the company owner’s approval on their phone.
What about prompt after prompt, until someone taps yes?
Each card shows what is being asked, so a request nobody made is easy to spot, and one refusal stops it. For group approvals the person named as asking confirms first, so a request they never made never reaches their colleagues.
Can our administrators, or TapSign staff, approve on someone’s behalf?
No. Each approval is a signature made on the named person’s own enrolled phone, behind their face or fingerprint. Administrators can remove a phone; they cannot approve with it.
Do staff need new phones?
No. The TapSign app runs on current iPhones and Android phones with a face or fingerprint sensor, company or personal.
What if a phone is lost or stolen?
The phone alone approves nothing: every approval needs the owner’s face or fingerprint. If anyone adds a new face or fingerprint to the phone, its TapSign key is destroyed. Your administrator removes the lost phone from the company.
Can a deepfake approve?
A deepfake video or a cloned voice can fool a person on a call. It cannot reach the sensor in the phone, and the key that approves never leaves the phone’s security chip. For the actions where that risk matters, require two people.
Can banks and government services use TapSign against deepfakes?
Yes, for the actions that matter. A bank or a government service can require that a payment, an account change or a sign-in is approved on the person’s own enrolled phone, with their face or fingerprint. A cloned voice or a fake video can persuade someone on a call, but it cannot produce that approval.
What if someone leaves the company?
Remove them, and their phone stops counting at once, even for requests already waiting.
What happens when a request is refused?
Nothing executes. The request is recorded as refused, with the phone and the time that refused it.
Who decides which actions need approval?
You do. You choose which actions require approval and who must approve them. Everything else works as before.
Do approvals ever use text-message codes?
No. Approvals happen in the TapSign app, so there is no code to intercept or pass on.
Does it work with email?
Yes. In Gmail and Outlook on the web, the TapSign browser extension adds a “Signed by” mark to mail the sender approved on their phone, so staff and clients can tell a real instruction from one sent by someone else.
What is TapSign Mail?
TapSign Mail lets the people who receive your company’s email tell a real message from a fake one. An important email, such as a payment instruction, is signed personally: the sender approves that exact email on their phone and it arrives marked as signed by them. Internal staff mail and automated mail can carry your company’s verified mark without a tap.
What do the marks on an email mean?
Signed by a person: the named sender approved this exact email on their own phone. Verified domain, staff: the email really came from your company’s verified domain, sent by staff your company chose; it proves the company, not which person (shown in Gmail with the TapSign extension). Automated: a receipt, invoice or reset email signed by your company’s approved sending server. No mark means no TapSign proof, so treat any instruction in it with care.
When should an email be signed personally?
Whenever acting on it matters: payment instructions, bank detail changes, contracts, sharing client files. Recipients then know the named person approved that exact email, not just that it came from your domain.
Can our automated emails, like receipts and password resets, be marked too?
Yes. Your sending server signs each automated email through TapSign, and only senders you approve on your phone can do it, so a look-alike receipt or reset email from someone else carries no mark.
Can I check an email on my phone when I am away from my laptop?
Yes. Add your email address in the TapSign app’s Verify Inbox and the signed emails sent to you appear there. Tap Verify to see whether an email was signed by the named person or by your company’s approved automated sender; one that fails the check is flagged.
Can it run on our own servers?
Yes. Use TapSign cloud, or the same product on your own infrastructure.
Before we connect anything, can you check our own systems?
Yes. Our developer scanner runs on your own machine and uploads nothing. It shows where an action could skip the approval, and flags known weaknesses and exposed secrets in your code. It checks code, not your live network.
How much does it cost?
There is a free plan to start. Paid plans are on the Pricing page; enterprise and on-premises are quoted for your volume.
How is signed email charged? Is it per person?
Signed email is included in the Starter, Growth and Enterprise plans. There is no charge per signed email and no extra charge per person, and signing does not use up your monthly verifications. Everyone who signs uses the TapSign app on their own phone, and your plan sets how many: Starter has 10 staff and 10 sending addresses, Growth 25 and 25, Enterprise up to 10,000. Need more people? Move up a plan. The Free plan can check signed email but cannot send it, and checking a signed email you receive is free on every plan.
What about receipts, order emails and marketing email?
Email your own server sends automatically, such as receipts, order confirmations, password resets and marketing, carries your company’s verified TapSign mark. Each plan includes a monthly amount: Starter 50,000, Growth 500,000, Enterprise 5,000,000 or more by contract, and on-premise has no cap. There is no charge per email. If you reach the amount, your email still goes out, without the mark, until the 1st of the next month or an upgrade. The Free plan does not include it.
How do we get started?
Book a demo, or start free: install the TapSign app and scan your workspace QR code to enrol the phone that will approve.
Contact us
Customer support with ease.
Ask us anything and we will help you find the answer. Response time is within 24 hours.
Help Centre
Ask us anything and check the help centre for answers.
Integration support
Onboarding, SDK setup, integrations and business queries.
Ticket Support
Raise a ticket and track it to resolution.
Contact details
Talk to the TapSign team directly.
Newhaven, East Sussex, UK
Start using TapSign today
Protect your first sign-in, payment or email with TapSign in minutes.
Legal
Terms of Use
Last updated January 30, 2023
TABLE OF CONTENTS
1. AGREEMENT TO TERMS
2. INTELLECTUAL PROPERTY RIGHTS
3. USER REPRESENTATIONS
4. USER REGISTRATION
5. PROHIBITED ACTIVITIES
6. USER GENERATED CONTRIBUTIONS
7. CONTRIBUTION LICENSE
8. GUIDELINES FOR REVIEWS
9. MOBILE APPLICATION LICENSE
10. SUBMISSIONS
11. THIRD-PARTY WEBSITE AND CONTENT
12. SITE MANAGEMENT
13. PRIVACY POLICY
14. TERM AND TERMINATION
15. MODIFICATIONS AND INTERRUPTIONS
16. GOVERNING LAW
17. DISPUTE RESOLUTION
18. CORRECTIONS
19. DISCLAIMER
20. LIMITATIONS OF LIABILITY
21. INDEMNIFICATION
22. USER DATA
23. ELECTRONIC COMMUNICATIONS, TRANSACTIONS, AND SIGNATURES
24. MISCELLANEOUS
25. CONTACT US
1. AGREEMENT TO TERMS
These Terms of Use constitute a legally binding agreement made between you, whether personally or on behalf of an entity (“you”) and PG Digital Service Ltd, doing business as TapSign (" tapsign ," “ we ," “ us ," or “ our ”), concerning your access to and use of the https://tapsign.net website as well as any other media form, media channel, mobile website or mobile application related, linked, or otherwise connected thereto (collectively, the “Site”). We are registered in England and Wales under company number 16974046 and have our office at Newhaven, East Sussex, United Kingdom. You agree that by accessing the Site, you have read, understood, and agreed to be bound by all of these Terms of Use. IF YOU DO NOT AGREE WITH ALL OF THESE TERMS OF USE, THEN YOU ARE EXPRESSLY PROHIBITED FROM USING THE SITE AND YOU MUST DISCONTINUE USE IMMEDIATELY.
Supplemental terms and conditions or documents that may be posted on the Site from time to time are hereby expressly incorporated herein by reference. We reserve the right, in our sole discretion, to make changes or modifications to these Terms of Use at any time and for any reason. We will alert you about any changes by updating the “Last updated” date of these Terms of Use, and you waive any right to receive specific notice of each such change. Please ensure that you check the applicable Terms every time you use our Site so that you understand which Terms apply. You will be subject to, and will be deemed to have been made aware of and to have accepted, the changes in any revised Terms of Use by your continued use of the Site after the date such revised Terms of Use are posted.
The information provided on the Site is not intended for distribution to or use by any person or entity in any jurisdiction or country where such distribution or use would be contrary to law or regulation or which would subject us to any registration requirement within such jurisdiction or country. Accordingly, those persons who choose to access the Site from other locations do so on their own initiative and are solely responsible for compliance with local laws, if and to the extent local laws are applicable.
The Site is intended for users who are at least 13 years of age. All users who are minors in the jurisdiction in which they reside (generally under the age of 18) must have the permission of, and be directly supervised by, their parent or guardian to use the Site. If you are a minor, you must have your parent or guardian read and agree to these Terms of Use prior to you using the Site.
2. INTELLECTUAL PROPERTY RIGHTS
Unless otherwise indicated, the Site is our proprietary property and all source code, databases, functionality, software, website designs, audio, video, text, photographs, and graphics on the Site (collectively, the “Content”) and the trademarks, service marks, and logos contained therein (the “Marks”) are owned or controlled by us or licensed to us, and are protected by copyright and trademark laws and various other intellectual property rights and unfair competition laws of the United States, international copyright laws, and international conventions. The Content and the Marks are provided on the Site “AS IS” for your information and personal use only. Except as expressly provided in these Terms of Use, no part of the Site and no Content or Marks may be copied, reproduced, aggregated, republished, uploaded, posted, publicly displayed, encoded, translated, transmitted, distributed, sold, licensed, or otherwise exploited for any commercial purpose whatsoever, without our express prior written permission.
Provided that you are eligible to use the Site, you are granted a limited license to access and use the Site and to download or print a copy of any portion of the Content to which you have properly gained access solely for your personal, non-commercial use. We reserve all rights not expressly granted to you in and to the Site, the Content and the Marks.
3. USER REPRESENTATIONS
By using the Site, you represent and warrant that: ( 1 ) all registration information you submit will be true, accurate, current, and complete; ( 2 ) you will maintain the accuracy of such information and promptly update such registration information as necessary ; ( 3 ) you have the legal capacity and you agree to comply with these Terms of Use; ( 4 ) you are not under the age of 13; ( 5 ) you are not a minor in the jurisdiction in which you reside, or if a minor, you have received parental permission to use the Site; ( 6 ) you will not access the Site through automated or non-human means, whether through a bot, script, or otherwise; ( 7 ) you will not use the Site for any illegal or unauthorized purpose; and ( 8 ) your use of the Site will not violate any applicable law or regulation.
If you provide any information that is untrue, inaccurate, not current, or incomplete, we have the right to suspend or terminate your account and refuse any and all current or future use of the Site (or any portion thereof).
4. USER REGISTRATION
You may be required to register with the Site. You agree to keep your password confidential and will be responsible for all use of your account and password. We reserve the right to remove, reclaim, or change a username you select if we determine, in our sole discretion, that such username is inappropriate, obscene, or otherwise objectionable.
5. PROHIBITED ACTIVITIES
You may not access or use the Site for any purpose other than that for which we make the Site available. The Site may not be used in connection with any commercial endeavors except those that are specifically endorsed or approved by us.
As a user of the Site, you agree not to:
- Systematically retrieve data or other content from the Site to create or compile, directly or indirectly, a collection, compilation, database, or directory without written permission from us.
- Trick, defraud, or mislead us and other users, especially in any attempt to learn sensitive account information such as user passwords.
- Circumvent, disable, or otherwise interfere with security-related features of the Site, including features that prevent or restrict the use or copying of any Content or enforce limitations on the use of the Site and/or the Content contained therein.
- Disparage, tarnish, or otherwise harm, in our opinion, us and/or the Site.
- Use any information obtained from the Site in order to harass, abuse, or harm another person.
- Make improper use of our support services or submit false reports of abuse or misconduct.
- Use the Site in a manner inconsistent with any applicable laws or regulations.
- Engage in unauthorized framing of or linking to the Site.
- Upload or transmit (or attempt to upload or to transmit) viruses, Trojan horses, or other material, including excessive use of capital letters and spamming (continuous posting of repetitive text), that interferes with any party’s uninterrupted use and enjoyment of the Site or modifies, impairs, disrupts, alters, or interferes with the use, features, functions, operation, or maintenance of the Site.
- Engage in any automated use of the system, such as using scripts to send comments or messages, or using any data mining, robots, or similar data gathering and extraction tools.
- Delete the copyright or other proprietary rights notice from any Content.
- Attempt to impersonate another user or person or use the username of another user.
- Upload or transmit (or attempt to upload or to transmit) any material that acts as a passive or active information collection or transmission mechanism, including without limitation, clear graphics interchange formats (“gifs”), 1×1 pixels, web bugs, cookies, or other similar devices (sometimes referred to as “spyware” or “passive collection mechanisms” or “pcms”).
- Interfere with, disrupt, or create an undue burden on the Site or the networks or services connected to the Site.
- Harass, annoy, intimidate, or threaten any of our employees or agents engaged in providing any portion of the Site to you.
- Attempt to bypass any measures of the Site designed to prevent or restrict access to the Site, or any portion of the Site.
- Copy or adapt the Site’s software, including but not limited to Flash, PHP, HTML, JavaScript, or other code.
- Except as permitted by applicable law, decipher, decompile, disassemble, or reverse engineer any of the software comprising or in any way making up a part of the Site.
- Except as may be the result of standard search engine or Internet browser usage, use, launch, develop, or distribute any automated system, including without limitation, any spider, robot, cheat utility, scraper, or offline reader that accesses the Site, or using or launching any unauthorized script or other software.
- Use a buying agent or purchasing agent to make purchases on the Site.
- Make any unauthorized use of the Site, including collecting usernames and/or email addresses of users by electronic or other means for the purpose of sending unsolicited email, or creating user accounts by automated means or under false pretenses.
- Use the Site as part of any effort to compete with us or otherwise use the Site and/or the Content for any revenue-generating endeavor or commercial enterprise.
- iligal activities in any forms
6. USER GENERATED CONTRIBUTIONS
The Site may invite you to chat, contribute to, or participate in blogs, message boards, online forums, and other functionality, and may provide you with the opportunity to create, submit, post, display, transmit, perform, publish, distribute, or broadcast content and materials to us or on the Site, including but not limited to text, writings, video, audio, photographs, graphics, comments, suggestions, or personal information or other material (collectively, "Contributions"). Contributions may be viewable by other users of the Site and through third-party websites. As such, any Contributions you transmit may be treated as non-confidential and non-proprietary. When you create or make available any Contributions, you thereby represent and warrant that:
- The creation, distribution, transmission, public display, or performance, and the accessing, downloading, or copying of your Contributions do not and will not infringe the proprietary rights, including but not limited to the copyright, patent, trademark, trade secret, or moral rights of any third party.
- You are the creator and owner of or have the necessary licenses, rights, consents, releases, and permissions to use and to authorize us, the Site, and other users of the Site to use your Contributions in any manner contemplated by the Site and these Terms of Use.
- You have the written consent, release, and/or permission of each and every identifiable individual person in your Contributions to use the name or likeness of each and every such identifiable individual person to enable inclusion and use of your Contributions in any manner contemplated by the Site and these Terms of Use.
- Your Contributions are not false, inaccurate, or misleading.
- Your Contributions are not unsolicited or unauthorized advertising, promotional materials, pyramid schemes, chain letters, spam, mass mailings, or other forms of solicitation.
- Your Contributions are not obscene, lewd, lascivious, filthy, violent, harassing, libelous, slanderous, or otherwise objectionable (as determined by us).
- Your Contributions do not ridicule, mock, disparage, intimidate, or abuse anyone.
- Your Contributions are not used to harass or threaten (in the legal sense of those terms) any other person and to promote violence against a specific person or class of people.
- Your Contributions do not violate any applicable law, regulation, or rule.
- Your Contributions do not violate the privacy or publicity rights of any third party.
- Your Contributions do not violate any applicable law concerning child pornography, or otherwise intended to protect the health or well-being of minors.
- Your Contributions do not include any offensive comments that are connected to race, national origin, gender, sexual preference, or physical handicap.
- Your Contributions do not otherwise violate, or link to material that violates, any provision of these Terms of Use, or any applicable law or regulation.
Any use of the Site in violation of the foregoing violates these Terms of Use and may result in, among other things, termination or suspension of your rights to use the Site.
7. CONTRIBUTION LICENSE
By posting your Contributions to any part of the Site, you automatically grant, and you represent and warrant that you have the right to grant, to us an unrestricted, unlimited, irrevocable, perpetual, non-exclusive, transferable, royalty-free, fully-paid, worldwide right, and license to host, use, copy, reproduce, disclose, sell, resell, publish, broadcast, retitle, archive, store, cache, publicly perform, publicly display, reformat, translate, transmit, excerpt (in whole or in part), and distribute such Contributions (including, without limitation, your image and voice) for any purpose, commercial, advertising, or otherwise, and to prepare derivative works of, or incorporate into other works, such Contributions, and grant and authorize sublicenses of the foregoing. The use and distribution may occur in any media formats and through any media channels.
This license will apply to any form, media, or technology now known or hereafter developed, and includes our use of your name, company name, and franchise name, as applicable, and any of the trademarks, service marks, trade names, logos, and personal and commercial images you provide. You waive all moral rights in your Contributions, and you warrant that moral rights have not otherwise been asserted in your Contributions.
We do not assert any ownership over your Contributions. You retain full ownership of all of your Contributions and any intellectual property rights or other proprietary rights associated with your Contributions. We are not liable for any statements or representations in your Contributions provided by you in any area on the Site. You are solely responsible for your Contributions to the Site and you expressly agree to exonerate us from any and all responsibility and to refrain from any legal action against us regarding your Contributions.
We have the right, in our sole and absolute discretion, (1) to edit, redact, or otherwise change any Contributions; (2) to re-categorize any Contributions to place them in more appropriate locations on the Site; and (3) to pre-screen or delete any Contributions at any time and for any reason, without notice. We have no obligation to monitor your Contributions.
8. GUIDELINES FOR REVIEWS
We may provide you areas on the Site to leave reviews or ratings. When posting a review, you must comply with the following criteria: (1) you should have firsthand experience with the person/entity being reviewed; (2) your reviews should not contain offensive profanity, or abusive, racist, offensive, or hate language; (3) your reviews should not contain discriminatory references based on religion, race, gender, national origin, age, marital status, sexual orientation, or disability; (4) your reviews should not contain references to illegal activity; (5) you should not be affiliated with competitors if posting negative reviews; (6) you should not make any conclusions as to the legality of conduct; (7) you may not post any false or misleading statements; and (8) you may not organize a campaign encouraging others to post reviews, whether positive or negative.
We may accept, reject, or remove reviews in our sole discretion. We have absolutely no obligation to screen reviews or to delete reviews, even if anyone considers reviews objectionable or inaccurate. Reviews are not endorsed by us, and do not necessarily represent our opinions or the views of any of our affiliates or partners. We do not assume liability for any review or for any claims, liabilities, or losses resulting from any review. By posting a review, you hereby grant to us a perpetual, non-exclusive, worldwide, royalty-free, fully-paid, assignable, and sublicensable right and license to reproduce, modify, translate, transmit by any means, display, perform, and/or distribute all content relating to reviews.
9. MOBILE APPLICATION LICENSE
Use License
If you access the Site via a mobile application, then we grant you a revocable, non-exclusive, non-transferable, limited right to install and use the mobile application on wireless electronic devices owned or controlled by you, and to access and use the mobile application on such devices strictly in accordance with the terms and conditions of this mobile application license contained in these Terms of Use. You shall not: (1) except as permitted by applicable law, decompile, reverse engineer, disassemble, attempt to derive the source code of, or decrypt the application; (2) make any modification, adaptation, improvement, enhancement, translation, or derivative work from the application; (3) violate any applicable laws, rules, or regulations in connection with your access or use of the application; (4) remove, alter, or obscure any proprietary notice (including any notice of copyright or trademark) posted by us or the licensors of the application; (5) use the application for any revenue generating endeavor, commercial enterprise, or other purpose for which it is not designed or intended; (6) make the application available over a network or other environment permitting access or use by multiple devices or users at the same time; (7) use the application for creating a product, service, or software that is, directly or indirectly, competitive with or in any way a substitute for the application; (8) use the application to send automated queries to any website or to send any unsolicited commercial e-mail; or (9) use any proprietary information or any of our interfaces or our other intellectual property in the design, development, manufacture, licensing, or distribution of any applications, accessories, or devices for use with the application.
Apple and Android Devices
The following terms apply when you use a mobile application obtained from either the Apple Store or Google Play (each an “App Distributor”) to access the Site: (1) the license granted to you for our mobile application is limited to a non-transferable license to use the application on a device that utilizes the Apple iOS or Android operating systems, as applicable, and in accordance with the usage rules set forth in the applicable App Distributor’s terms of service; (2) we are responsible for providing any maintenance and support services with respect to the mobile application as specified in the terms and conditions of this mobile application license contained in these Terms of Use or as otherwise required under applicable law, and you acknowledge that each App Distributor has no obligation whatsoever to furnish any maintenance and support services with respect to the mobile application; (3) in the event of any failure of the mobile application to conform to any applicable warranty, you may notify the applicable App Distributor, and the App Distributor, in accordance with its terms and policies, may refund the purchase price, if any, paid for the mobile application, and to the maximum extent permitted by applicable law, the App Distributor will have no other warranty obligation whatsoever with respect to the mobile application; (4) you represent and warrant that (i) you are not located in a country that is subject to a U.S. government embargo, or that has been designated by the U.S. government as a “terrorist supporting” country and (ii) you are not listed on any U.S. government list of prohibited or restricted parties; (5) you must comply with applicable third-party terms of agreement when using the mobile application, e.g., if you have a VoIP application, then you must not be in violation of their wireless data service agreement when using the mobile application; and (6) you acknowledge and agree that the App Distributors are third-party beneficiaries of the terms and conditions in this mobile application license contained in these Terms of Use, and that each App Distributor will have the right (and will be deemed to have accepted the right) to enforce the terms and conditions in this mobile application license contained in these Terms of Use against you as a third-party beneficiary thereof.
10. SUBMISSIONS
You acknowledge and agree that any questions, comments, suggestions, ideas, feedback, or other information regarding the Site ("Submissions") provided by you to us are non-confidential and shall become our sole property. We shall own exclusive rights, including all intellectual property rights, and shall be entitled to the unrestricted use and dissemination of these Submissions for any lawful purpose, commercial or otherwise, without acknowledgment or compensation to you. You hereby waive all moral rights to any such Submissions, and you hereby warrant that any such Submissions are original with you or that you have the right to submit such Submissions. You agree there shall be no recourse against us for any alleged or actual infringement or misappropriation of any proprietary right in your Submissions.
11. THIRD-PARTY WEBSITE AND CONTENT
The Site may contain (or you may be sent via the Site) links to other websites ("Third-Party Websites") as well as articles, photographs, text, graphics, pictures, designs, music, sound, video, information, applications, software, and other content or items belonging to or originating from third parties ("Third-Party Content"). Such Third-Party Websites and Third-Party Content are not investigated, monitored, or checked for accuracy, appropriateness, or completeness by us, and we are not responsible for any Third-Party Websites accessed through the Site or any Third-Party Content posted on, available through, or installed from the Site, including the content, accuracy, offensiveness, opinions, reliability, privacy practices, or other policies of or contained in the Third-Party Websites or the Third-Party Content. Inclusion of, linking to, or permitting the use or installation of any Third-Party Websites or any Third-Party Content does not imply approval or endorsement thereof by us. If you decide to leave the Site and access the Third-Party Websites or to use or install any Third-Party Content, you do so at your own risk, and you should be aware these Terms of Use no longer govern. You should review the applicable terms and policies, including privacy and data gathering practices, of any website to which you navigate from the Site or relating to any applications you use or install from the Site. Any purchases you make through Third-Party Websites will be through other websites and from other companies, and we take no responsibility whatsoever in relation to such purchases which are exclusively between you and the applicable third party. You agree and acknowledge that we do not endorse the products or services offered on Third-Party Websites and you shall hold us harmless from any harm caused by your purchase of such products or services. Additionally, you shall hold us harmless from any losses sustained by you or harm caused to you relating to or resulting in any way from any Third-Party Content or any contact with Third-Party Websites.
12. SITE MANAGEMENT
We reserve the right, but not the obligation, to: (1) monitor the Site for violations of these Terms of Use; (2) take appropriate legal action against anyone who, in our sole discretion, violates the law or these Terms of Use, including without limitation, reporting such user to law enforcement authorities; (3) in our sole discretion and without limitation, refuse, restrict access to, limit the availability of, or disable (to the extent technologically feasible) any of your Contributions or any portion thereof; (4) in our sole discretion and without limitation, notice, or liability, to remove from the Site or otherwise disable all files and content that are excessive in size or are in any way burdensome to our systems; and (5) otherwise manage the Site in a manner designed to protect our rights and property and to facilitate the proper functioning of the Site.
13. PRIVACY POLICY
We care about data privacy and security. Please review our Privacy Policy: https://tapsign.net/privacy-policy/ . By using the Site, you agree to be bound by our Privacy Policy, which is incorporated into these Terms of Use. Please be advised the Site is hosted in the United States . If you access the Site from any other region of the world with laws or other requirements governing personal data collection, use, or disclosure that differ from applicable laws in the United States , then through your continued use of the Site, you are transferring your data to the United States , and you agree to have your data transferred to and processed in the United States .
14. TERM AND TERMINATION
These Terms of Use shall remain in full force and effect while you use the Site. WITHOUT LIMITING ANY OTHER PROVISION OF THESE TERMS OF USE, WE RESERVE THE RIGHT TO, IN OUR SOLE DISCRETION AND WITHOUT NOTICE OR LIABILITY, DENY ACCESS TO AND USE OF THE SITE (INCLUDING BLOCKING CERTAIN IP ADDRESSES), TO ANY PERSON FOR ANY REASON OR FOR NO REASON, INCLUDING WITHOUT LIMITATION FOR BREACH OF ANY REPRESENTATION, WARRANTY, OR COVENANT CONTAINED IN THESE TERMS OF USE OR OF ANY APPLICABLE LAW OR REGULATION. WE MAY TERMINATE YOUR USE OR PARTICIPATION IN THE SITE OR DELETE YOUR ACCOUNT AND ANY CONTENT OR INFORMATION THAT YOU POSTED AT ANY TIME, WITHOUT WARNING, IN OUR SOLE DISCRETION.
If we terminate or suspend your account for any reason, you are prohibited from registering and creating a new account under your name, a fake or borrowed name, or the name of any third party, even if you may be acting on behalf of the third party. In addition to terminating or suspending your account, we reserve the right to take appropriate legal action, including without limitation pursuing civil, criminal, and injunctive redress.
15. MODIFICATIONS AND INTERRUPTIONS
We reserve the right to change, modify, or remove the contents of the Site at any time or for any reason at our sole discretion without notice. However, we have no obligation to update any information on our Site. We also reserve the right to modify or discontinue all or part of the Site without notice at any time. We will not be liable to you or any third party for any modification, price change, suspension, or discontinuance of the Site.
We cannot guarantee the Site will be available at all times. We may experience hardware, software, or other problems or need to perform maintenance related to the Site, resulting in interruptions, delays, or errors. We reserve the right to change, revise, update, suspend, discontinue, or otherwise modify the Site at any time or for any reason without notice to you. You agree that we have no liability whatsoever for any loss, damage, or inconvenience caused by your inability to access or use the Site during any downtime or discontinuance of the Site. Nothing in these Terms of Use will be construed to obligate us to maintain and support the Site or to supply any corrections, updates, or releases in connection therewith.
16. GOVERNING LAW
These Terms shall be governed by and defined following the laws of England and Wales. PG Digital Service Ltd and yourself irrevocably consent that the courts of England and Wales shall have exclusive jurisdiction to resolve any dispute which may arise in connection with these terms.
17. DISPUTE RESOLUTION
Binding Arbitration
Any dispute arising out of or in connection with this contract, including any question regarding its existence, validity or termination, shall be referred to and finally resolved by the International Commercial Arbitration Court under the European Arbitration Chamber (Belgium, Brussels, Avenue Louise, 146) according to the Rules of this ICAC, which, as a result of referring to it, is considered as the part of this clause. The number of arbitrators shall be __________. The seat, or legal place, of arbitration shall be __________ . The language of the proceedings shall be __________. The governing law of the contract shall be the substantive law of __________ .
Restrictions
The Parties agree that any arbitration shall be limited to the Dispute between the Parties individually. To the full extent permitted by law, (a) no arbitration shall be joined with any other proceeding; (b) there is no right or authority for any Dispute to be arbitrated on a class-action basis or to utilize class action procedures; and (c) there is no right or authority for any Dispute to be brought in a purported representative capacity on behalf of the general public or any other persons.
Exceptions to Arbitration
The Parties agree that the following Disputes are not subject to the above provisions concerning binding arbitration: (a) any Disputes seeking to enforce or protect, or concerning the validity of, any of the intellectual property rights of a Party; (b) any Dispute related to, or arising from, allegations of theft, piracy, invasion of privacy, or unauthorized use; and (c) any claim for injunctive relief. If this provision is found to be illegal or unenforceable, then neither Party will elect to arbitrate any Dispute falling within that portion of this provision found to be illegal or unenforceable and such Dispute shall be decided by a court of competent jurisdiction within the courts listed for jurisdiction above, and the Parties agree to submit to the personal jurisdiction of that court.
18. CORRECTIONS
There may be information on the Site that contains typographical errors, inaccuracies, or omissions, including descriptions, pricing, availability, and various other information. We reserve the right to correct any errors, inaccuracies, or omissions and to change or update the information on the Site at any time, without prior notice.
19. DISCLAIMER
THE SITE IS PROVIDED ON AN AS-IS AND AS-AVAILABLE BASIS. YOU AGREE THAT YOUR USE OF THE SITE AND OUR SERVICES WILL BE AT YOUR SOLE RISK. TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, IN CONNECTION WITH THE SITE AND YOUR USE THEREOF, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE MAKE NO WARRANTIES OR REPRESENTATIONS ABOUT THE ACCURACY OR COMPLETENESS OF THE SITE’S CONTENT OR THE CONTENT OF ANY WEBSITES LINKED TO THE SITE AND WE WILL ASSUME NO LIABILITY OR RESPONSIBILITY FOR ANY (1) ERRORS, MISTAKES, OR INACCURACIES OF CONTENT AND MATERIALS, (2) PERSONAL INJURY OR PROPERTY DAMAGE, OF ANY NATURE WHATSOEVER, RESULTING FROM YOUR ACCESS TO AND USE OF THE SITE, (3) ANY UNAUTHORIZED ACCESS TO OR USE OF OUR SECURE SERVERS AND/OR ANY AND ALL PERSONAL INFORMATION AND/OR FINANCIAL INFORMATION STORED THEREIN, (4) ANY INTERRUPTION OR CESSATION OF TRANSMISSION TO OR FROM THE SITE, (5) ANY BUGS, VIRUSES, TROJAN HORSES, OR THE LIKE WHICH MAY BE TRANSMITTED TO OR THROUGH THE SITE BY ANY THIRD PARTY, AND/OR (6) ANY ERRORS OR OMISSIONS IN ANY CONTENT AND MATERIALS OR FOR ANY LOSS OR DAMAGE OF ANY KIND INCURRED AS A RESULT OF THE USE OF ANY CONTENT POSTED, TRANSMITTED, OR OTHERWISE MADE AVAILABLE VIA THE SITE. WE DO NOT WARRANT, ENDORSE, GUARANTEE, OR ASSUME RESPONSIBILITY FOR ANY PRODUCT OR SERVICE ADVERTISED OR OFFERED BY A THIRD PARTY THROUGH THE SITE, ANY HYPERLINKED WEBSITE, OR ANY WEBSITE OR MOBILE APPLICATION FEATURED IN ANY BANNER OR OTHER ADVERTISING, AND WE WILL NOT BE A PARTY TO OR IN ANY WAY BE RESPONSIBLE FOR MONITORING ANY TRANSACTION BETWEEN YOU AND ANY THIRD-PARTY PROVIDERS OF PRODUCTS OR SERVICES. AS WITH THE PURCHASE OF A PRODUCT OR SERVICE THROUGH ANY MEDIUM OR IN ANY ENVIRONMENT, YOU SHOULD USE YOUR BEST JUDGMENT AND EXERCISE CAUTION WHERE APPROPRIATE.
20. LIMITATIONS OF LIABILITY
IN NO EVENT WILL WE OR OUR DIRECTORS, EMPLOYEES, OR AGENTS BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFIT, LOST REVENUE, LOSS OF DATA, OR OTHER DAMAGES ARISING FROM YOUR USE OF THE SITE, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
21. INDEMNIFICATION
You agree to defend, indemnify, and hold us harmless, including our subsidiaries, affiliates, and all of our respective officers, agents, partners, and employees, from and against any loss, damage, liability, claim, or demand, including reasonable attorneys’ fees and expenses, made by any third party due to or arising out of: (1) your Contributions; ( 2 ) use of the Site; ( 3 ) breach of these Terms of Use; ( 4 ) any breach of your representations and warranties set forth in these Terms of Use; ( 5 ) your violation of the rights of a third party, including but not limited to intellectual property rights; or ( 6 ) any overt harmful act toward any other user of the Site with whom you connected via the Site. Notwithstanding the foregoing, we reserve the right, at your expense, to assume the exclusive defense and control of any matter for which you are required to indemnify us, and you agree to cooperate, at your expense, with our defense of such claims. We will use reasonable efforts to notify you of any such claim, action, or proceeding which is subject to this indemnification upon becoming aware of it.
22. USER DATA
We will maintain certain data that you transmit to the Site for the purpose of managing the performance of the Site, as well as data relating to your use of the Site. Although we perform regular routine backups of data, you are solely responsible for all data that you transmit or that relates to any activity you have undertaken using the Site. You agree that we shall have no liability to you for any loss or corruption of any such data, and you hereby waive any right of action against us arising from any such loss or corruption of such data.
23. ELECTRONIC COMMUNICATIONS, TRANSACTIONS, AND SIGNATURES
Visiting the Site, sending us emails, and completing online forms constitute electronic communications. You consent to receive electronic communications, and you agree that all agreements, notices, disclosures, and other communications we provide to you electronically, via email and on the Site, satisfy any legal requirement that such communication be in writing. YOU HEREBY AGREE TO THE USE OF ELECTRONIC SIGNATURES, CONTRACTS, ORDERS, AND OTHER RECORDS, AND TO ELECTRONIC DELIVERY OF NOTICES, POLICIES, AND RECORDS OF TRANSACTIONS INITIATED OR COMPLETED BY US OR VIA THE SITE. You hereby waive any rights or requirements under any statutes, regulations, rules, ordinances, or other laws in any jurisdiction which require an original signature or delivery or retention of non-electronic records, or to payments or the granting of credits by any means other than electronic means.
24. MISCELLANEOUS
These Terms of Use and any policies or operating rules posted by us on the Site or in respect to the Site constitute the entire agreement and understanding between you and us. Our failure to exercise or enforce any right or provision of these Terms of Use shall not operate as a waiver of such right or provision. These Terms of Use operate to the fullest extent permissible by law. We may assign any or all of our rights and obligations to others at any time. We shall not be responsible or liable for any loss, damage, delay, or failure to act caused by any cause beyond our reasonable control. If any provision or part of a provision of these Terms of Use is determined to be unlawful, void, or unenforceable, that provision or part of the provision is deemed severable from these Terms of Use and does not affect the validity and enforceability of any remaining provisions. There is no joint venture, partnership, employment or agency relationship created between you and us as a result of these Terms of Use or use of the Site. You agree that these Terms of Use will not be construed against us by virtue of having drafted them. You hereby waive any and all defenses you may have based on the electronic form of these Terms of Use and the lack of signing by the parties hereto to execute these Terms of Use.
25. CONTACT US
In order to resolve a complaint regarding the Site or to receive further information regarding use of the Site, please contact us at:
PG Digital Service Ltd
Newhaven, East Sussex
United Kingdom
Phone: +44 7598 604945
info@tapsign.net
These terms of use were created using Termly's Terms and Conditions .
Legal
Privacy Policy
Last updated March 09, 2023
This privacy notice for PG Digital Service Ltd, trading as TapSign (" Company ," " we ," " us ," or " our "), describes how and why we might collect, store, use, and/or share (" process ") your information when you use our services (" Services "), such as when you:
- Visit our website at https://tapsign.net , or any website of ours that links to this privacy notice
- Engage with us in other related ways ― including any sales, marketing, or events
Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at info@tapsign.net .
SUMMARY OF KEY POINTS
This summary provides key points from our privacy notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for. You can also click here to go directly to our table of contents.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with TapSign and the Services, the choices you make, and the products and features you use. Click here to learn more.
Do we process any sensitive personal information? We do not process sensitive personal information.
Do you receive any information from third parties? We do not receive any information from third parties.
How do you process my information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Click here to learn more.
In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Click here to learn more.
How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Click here to learn more.
What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Click here to learn more.
How do I exercise my rights? The easiest way to exercise your rights is by filling out our data subject request form available here , or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.
Want to learn more about what TapSign does with any information we collect? Click here to review the notice in full.
TABLE OF CONTENTS
1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. HOW LONG DO WE KEEP YOUR INFORMATION?
7. HOW DO WE KEEP YOUR INFORMATION SAFE?
8. DO WE COLLECT INFORMATION FROM MINORS?
9. WHAT ARE YOUR PRIVACY RIGHTS?
10. CONTROLS FOR DO-NOT-TRACK FEATURES
11. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
12. DO WE MAKE UPDATES TO THIS NOTICE?
13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
1. WHAT INFORMATION DO WE COLLECT?
Personal information you disclose to us
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:
- names
- phone numbers
- email addresses
- mailing addresses
Sensitive Information. We do not process sensitive information.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
2. HOW DO WE PROCESS YOUR INFORMATION?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
- To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
- To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
- To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.
If you are located in the EU or UK, this section applies to you.
The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:
- Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. Click here to learn more.
- Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information for some of the purposes described in order to:
- Diagnose problems and/or prevent fraudulent activities
- Understand how our users use our products and services so we can improve user experience
- Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
- Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.
In legal terms, we are generally the “data controller” under European data protection laws of the personal information described in this privacy notice, since we determine the means and/or purposes of the data processing we perform. This privacy notice does not apply to the personal information we process as a “data processor” on behalf of our customers. In those situations, the customer that we provide services to and with whom we have entered into a data processing agreement is the “data controller” responsible for your personal information, and we merely process your information on their behalf in accordance with your instructions. If you want to know more about our customers' privacy practices, you should read their privacy policies and direct any questions you have to them.
If you are located in Canada, this section applies to you.
We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time. Click here to learn more.
In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:
- If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
- For investigations and fraud detection and prevention
- For business transactions provided certain conditions are met
- If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
- For identifying injured, ill, or deceased persons and communicating with next of kin
- If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
- If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
- If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
- If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
- If the collection is solely for journalistic, artistic, or literary purposes
- If the information is publicly available and is specified by the regulations
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
In Short: We may share information in specific situations described in this section and/or with the following third parties.
We may need to share your personal information in the following situations:
- Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
- Business Partners. We may share your information with our business partners to offer you certain products, services, or promotions.
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
In Short: We may use cookies and other tracking technologies to collect and store your information.
We may use cookies and similar tracking technologies (like web beacons and pixels) to access or store information. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice : https://tapsign.net/cookie-policy/ .
6. HOW LONG DO WE KEEP YOUR INFORMATION?
In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this privacy notice unless otherwise required by law.
We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than 2 years .
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
7. HOW DO WE KEEP YOUR INFORMATION SAFE?
In Short: We aim to protect your personal information through a system of organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
8. DO WE COLLECT INFORMATION FROM MINORS?
In Short: We do not knowingly collect data from or market to children under 18 years of age.
We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at info@tapsign.net .
9. WHAT ARE YOUR PRIVACY RIGHTS?
In Short: In some regions, such as the European Economic Area (EEA), United Kingdom (UK), and Canada , you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time.
In some regions (like the EEA, UK, and Canada ), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; and (iv) if applicable, to data portability. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section “ HOW CAN YOU CONTACT US ABOUT THIS NOTICE? ” below.
We will consider and act upon any request in accordance with applicable data protection laws.
If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority. You can find their contact details here: https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm .
If you are located in Switzerland, the contact details for the data protection authorities are available here: https://www.edoeb.admin.ch/edoeb/en/home.html .
Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section " HOW CAN YOU CONTACT US ABOUT THIS NOTICE? " below .
However, please note that this will not affect the lawfulness of the processing before its withdrawal, nor when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.
Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services. To opt out of interest-based advertising by advertisers on our Services visit http://www.aboutads.info/choices/ . For further information, please see our Cookie Notice: https://tapsign.net/cookie-policy/ .
10. CONTROLS FOR DO-NOT-TRACK FEATURES
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.
11. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
In Short: Yes, if you are a resident of California, you are granted specific rights regarding access to your personal information.
California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.
If you are under 18 years of age, reside in California, and have a registered account with Services, you have the right to request removal of unwanted data that you publicly post on the Services. To request removal of such data, please contact us using the contact information provided below and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Services, but please be aware that the data may not be completely or comprehensively removed from all our systems (e.g., backups, etc.).
12. DO WE MAKE UPDATES TO THIS NOTICE?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this privacy notice from time to time. The updated version will be indicated by an updated "Revised" date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.
13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
If you have questions or comments about this notice, you may email us at info@tapsign.net or by post to:
PG Digital Service Ltd
Newhaven, East Sussex
United Kingdom
PG Digital Service Ltd is the "data controller" of your personal information. You can contact us about how we process it at info@tapsign.net or by post at the address above.
14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, change that information, or delete it in some circumstances. To request to review, update, or delete your personal information, please submit a request form by clicking here .
This privacy policy was created using Termly's Privacy Policy Generator .
Legal
Cookie Policy
Last updated March 09, 2023
This Cookie Policy explains how PG Digital Service Ltd, trading as TapSign (" Company ", " we ", " us ", and " our ") uses cookies and similar technologies to recognize you when you visit our websites at https://tapsign.net , (" Websites "). It explains what these technologies are and why we use them, as well as your rights to control our use of them.
In some cases we may use cookies to collect personal information, or that becomes personal information if we combine it with other information.
What are cookies?
Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are widely used by website owners in order to make their websites work, or to work more efficiently, as well as to provide reporting information.
Cookies set by the website owner (in this case, PG Digital Service Ltd ) are called "first party cookies". Cookies set by parties other than the website owner are called "third party cookies". Third party cookies enable third party features or functionality to be provided on or through the website (e.g. like advertising, interactive content and analytics). The parties that set these third party cookies can recognize your computer both when it visits the website in question and also when it visits certain other websites.
Why do we use cookies?
We use first and third party cookies for several reasons. Some cookies are required for technical reasons in order for our Websites to operate, and we refer to these as "essential" or "strictly necessary" cookies. Other cookies also enable us to track and target the interests of our users to enhance the experience on our Online Properties. Third parties serve cookies through our Websites for advertising, analytics and other purposes. This is described in more detail below.
The specific types of first and third party cookies served through our Websites and the purposes they perform are described below (please note that the specific cookies served may vary depending on the specific Online Properties you visit):
How can I control cookies?
You have the right to decide whether to accept or reject cookies. You can exercise your cookie rights by setting your preferences in the Cookie Consent Manager. The Cookie Consent Manager allows you to select which categories of cookies you accept or reject. Essential cookies cannot be rejected as they are strictly necessary to provide you with services.
The Cookie Consent Manager can be found in the notification banner and on our website. If you choose to reject cookies, you may still use our website though your access to some functionality and areas of our website may be restricted. You may also set or amend your web browser controls to accept or refuse cookies. As the means by which you can refuse cookies through your web browser controls vary from browser-to-browser, you should visit your browser's help menu for more information.
In addition, most advertising networks offer you a way to opt out of targeted advertising. If you would like to find out more information, please visit http://www.aboutads.info/choices/ or http://www.youronlinechoices.com .
The specific types of first and third party cookies served through our Websites and the purposes they perform are described in the table below (please note that the specific cookies served may vary depending on the specific Online Properties you visit):
Essential website cookies:
These cookies are strictly necessary to provide you with services available through our Websites and to use some of its features, such as access to secure areas.
Name: __tlbcpv
Purpose: Used to record unique visitor views of the consent banner.
Provider: .termly.io
Service: Termly View Service Privacy Policy
Country: United States
Type: http_cookie
Expires in: 1 year
What about other tracking technologies, like web beacons?
Cookies are not the only way to recognize or track visitors to a website. We may use other, similar technologies from time to time, like web beacons (sometimes called "tracking pixels" or "clear gifs"). These are tiny graphics files that contain a unique identifier that enable us to recognize when someone has visited our Websites or opened an e-mail including them . This allows us, for example, to monitor the traffic patterns of users from one page within a website to another, to deliver or communicate with cookies, to understand whether you have come to the website from an online advertisement displayed on a third-party website, to improve site performance, and to measure the success of e-mail marketing campaigns. In many instances, these technologies are reliant on cookies to function properly, and so declining cookies will impair their functioning.
Do you use Flash cookies or Local Shared Objects?
Websites may also use so-called "Flash Cookies" (also known as Local Shared Objects or "LSOs") to, among other things, collect and store information about your use of our services, fraud prevention and for other site operations.
If you do not want Flash Cookies stored on your computer, you can adjust the settings of your Flash player to block Flash Cookies storage using the tools contained in the Website Storage Settings Panel . You can also control Flash Cookies by going to the Global Storage Settings Panel and following the instructions (which may include instructions that explain, for example, how to delete existing Flash Cookies (referred to "information" on the Macromedia site), how to prevent Flash LSOs from being placed on your computer without your being asked, and (for Flash Player 8 and later) how to block Flash Cookies that are not being delivered by the operator of the page you are on at the time).
Please note that setting the Flash Player to restrict or limit acceptance of Flash Cookies may reduce or impede the functionality of some Flash applications, including, potentially, Flash applications used in connection with our services or online content.
Do you serve targeted advertising?
Third parties may serve cookies on your computer or mobile device to serve advertising through our Websites. These companies may use information about your visits to this and other websites in order to provide relevant advertisements about goods and services that you may be interested in. They may also employ technology that is used to measure the effectiveness of advertisements. This can be accomplished by them using cookies or web beacons to collect information about your visits to this and other sites in order to provide relevant advertisements about goods and services of potential interest to you. The information collected through this process does not enable us or them to identify your name, contact details or other details that directly identify you unless you choose to provide these.
How often will you update this Cookie Policy?
We may update this Cookie Policy from time to time in order to reflect, for example, changes to the cookies we use or for other operational, legal or regulatory reasons. Please therefore re-visit this Cookie Policy regularly to stay informed about our use of cookies and related technologies.
The date at the top of this Cookie Policy indicates when it was last updated.
Where can I get further information?
If you have any questions about our use of cookies or other technologies, please email us at info@tapsign.net or by post to:
PG Digital Service Ltd
Newhaven, East Sussex
__________
United Kingdom
Phone: +44 7598 604945
This cookie policy was created using Termly's Cookie Consent Manager .
TapSign developer docs
TapSign protects the actions that matter in your product: sign-in, payments, card use and admin changes. Your user approves on their phone, and your server acts only when TapSign confirms the approval.
Why teams choose TapSign
- Hardware-backed. Every approval is a cryptographic signature made inside the phone's secure hardware, after a fingerprint or Face ID.
- Phishing resistant. An approval is bound to one exact request, so it cannot be replayed, forwarded or reused.
- Adds to what you have. Keep your passwords, sessions and SSO. TapSign is the final check on top.
- Post-quantum ready. Server connections can carry an ML-DSA (NIST FIPS 204) co-signature, switched on per connector.
Quickstart
1. Create a connector
Sign in to the Enterprise portal, open Settings, then Server connector, and issue a connector bundle. Copy its values into your server environment.
TAPSIGN_BACKEND_URL=https://api.tapsign.net TAPSIGN_CLIENT_KEY_ID=tk_live_your_workspace TAPSIGN_CONNECTOR_ID=your-connector-id TAPSIGN_CONNECTOR_PRIVATE_KEY_B64=your-private-key TAPSIGN_CLIENT_CERT_FINGERPRINT=your-certificate-fingerprintKeep the private key on your server only. Never put it in an app, a web page or a repository.
2. Let your AI coding agent do it
With the TapSign MCP installed (see AI tools and VS Code), paste this into Claude Code, Cursor, GitHub Copilot or any MCP-capable agent:
Run tapsign_start on this project. Add TapSign approval to sign-in and payments following the TapSign rules, then run tapsign_verify and fix every BLOCK.3. Or add it by hand
Pick your use case from the menu: Protect sign-in, Approve payments, Card protection or Enterprise sign-in. Each page has copy-paste code for your server, your website and your app.
Every server call is signed with your connector key. Get the ready-made Node.js client from your AI agent ("give me the TapSign node-client template") or from the command line:
tapsign template node-client4. Test before you go live
Run these five checks against your own server. All five must pass.
- A real approval on the phone: the action runs once.
- The same approval sent a second time: refused.
- An approval for one action used for a different one: refused.
- No approval at all: refused.
- TapSign unreachable: refused.
Cloud or on-premises: what to set
Set the values for where your TapSign runs. Most teams use TapSign cloud and never need the on-premises values.
TapSign cloud
- TAPSIGN_BACKEND_URL: https://api.tapsign.net
- TAPSIGN_AUTH_MODE: connector
- TAPSIGN_CLIENT_KEY_ID, TAPSIGN_CONNECTOR_ID, TAPSIGN_CONNECTOR_PRIVATE_KEY_B64 and TAPSIGN_CLIENT_CERT_FINGERPRINT: from your connector bundle.
- TAPSIGN_MOBILE_API_BASE_URL: leave empty. Phones use the same address.
- Leave every on-premises value below empty. TapSign cloud checks your connector at its own edge.
On-premises (TapSign runs on your own server)
Everything in the cloud list, with your own server's address, plus the client certificate from your connector bundle. An on-premises TapSign refuses any connector call that does not present that certificate during the TLS handshake. Sending its fingerprint in a header is not enough.
TAPSIGN_BACKEND_URL=https://tapsign.your-company.internal TAPSIGN_MOBILE_API_BASE_URL=https://tapsign.your-company.com TAPSIGN_CLIENT_CERT_PEM=(the certificate block from your bundle) TAPSIGN_CLIENT_KEY_PEM=(the private key block from your bundle) TAPSIGN_SERVER_CA_PEM=(your TapSign server's certificate, if self-signed) TAPSIGN_BACKEND_CONNECT_ADDRESS=10.0.0.12- TAPSIGN_BACKEND_URL: your TapSign server's connector address. It must be reachable from your server, not only from your office network.
- TAPSIGN_MOBILE_API_BASE_URL: the address phones reach. Set it when phones cannot reach the server address, for example when your TapSign sits behind a tunnel.
- TAPSIGN_CLIENT_CERT_PEM and TAPSIGN_CLIENT_KEY_PEM: the two blocks in your connector bundle, whole, line breaks kept. The key block is secret: keep it on your server only.
- TAPSIGN_SERVER_CA_PEM: only when your TapSign server's certificate is not publicly trusted.
- TAPSIGN_BACKEND_CONNECT_ADDRESS: only when your TapSign server's name does not resolve from your server. An IP address; the name is still used to check the certificate.
iPhones, cloud and on-premises
List your own iOS app in the connector (TapSign portal, Settings, Server connector, "Edit IPs, origins & iOS apps") as TEAMID.bundle.id, for example ABCDE12345.com.yourcompany.app. Without it an iPhone can enrol inside your app but never approve. Android needs nothing extra.
Support
Stuck on an integration? Check Errors and fixes first, then contact us. We answer integration questions directly.
Protect sign-in
Your normal sign-in runs first. TapSign then asks the user's phone to approve, and your server creates the session only after TapSign confirms.
The flow
- Your server starts a login approval.
- The user approves on their phone with a fingerprint or Face ID.
- Your server confirms the approval with TapSign, then signs the user in.
1. Start the approval (server)
POST /login/approval/start
- client_key_id: your workspace key. Required.
- device_ref: the user's TapSign device, saved when they enrolled. Required.
- channel: web, mobile_app, desktop or extension.
- requested_mode: cross_device.
- risk_level: low, normal, high or critical.
- login_request_id: your own id for this sign-in attempt.
Returns session_id, challenge and expires_at.
app.post('/login', async (req, res) => { const user = await checkPassword(req.body); // your existing sign-in if (!user) return res.status(401).json({ error: 'invalid_credentials' }); const start = await tapsign.post('/login/approval/start', { client_key_id: process.env.TAPSIGN_CLIENT_KEY_ID, device_ref: user.tapsignDeviceRef, channel: 'web', requested_mode: 'cross_device', risk_level: 'high', login_request_id: crypto.randomUUID(), }); await pending.save(start.session_id, user.id); // hold the sign-in, issue nothing yet res.json({ approvalRequired: true, sessionId: start.session_id }); });2. Wait for the phone (website)
Show "Approve on your phone" and poll your own server. Your server reads the status from TapSign.
GET /login/approval/status?client_key_id=...&session_id=...
Status is pending, approved, denied or expired.
async function waitForApproval(sessionId) { for (;;) { const { status } = await fetch(`/login/status?sessionId=${sessionId}`).then((r) => r.json()); if (status === 'approved') return completeLogin(sessionId); if (status === 'denied' || status === 'expired') return showRetry(); await new Promise((r) => setTimeout(r, 2000)); } }3. Confirm and sign in (server)
POST /auth/session/consume
- client_key_id: your workspace key.
- session_id: from step 1.
- action: login_step_up.
- request_context: the same value every time for this kind of action, for example login:USER_ID.
Create the session only when this returns HTTP 200. Any other answer, or no answer, means no sign-in.
app.post('/login/complete', async (req, res) => { const userId = await pending.take(req.body.sessionId); if (!userId) return res.status(410).json({ error: 'expired' }); try { await tapsign.post('/auth/session/consume', { client_key_id: process.env.TAPSIGN_CLIENT_KEY_ID, session_id: req.body.sessionId, action: 'login_step_up', request_context: `login:${userId}`, }); } catch { return res.status(403).json({ error: 'not_approved' }); } res.json(await createSession(userId)); });Enrol the user's phone
A user approves with a phone they enrolled once.
POST /device/bootstrap/token with purpose register returns bootstrap_session_id, deep_link_url and expires_at.
- Website on a computer: show deep_link_url as a QR code for the TapSign app to scan.
- Website on a phone: show an "Open in the app" button with the same link.
- Your own mobile app: enrol inside the app with the TapSign SDK. See Mobile apps.
When the user has finished, call POST /device/bootstrap/resolve with the bootstrap_session_id and save bound_public_device_ref as the user's device_ref.
Approve payments and actions
Withdrawals, transfers, bank detail changes, admin actions: anything that should never happen without the account holder. The user sees the exact amount and target on their phone and approves it there.
1. Start the approval (server)
POST /payment/approval/start
- client_key_id: your workspace key. Required.
- device_ref: the user's TapSign device. Required.
- operation: what is happening, for example withdraw, transfer or change_bank.
- amount_minor: the amount in minor units, for example 1250 for 12.50.
- currency: ISO code, for example USD, EUR or GBP.
- target_ref: who or what receives it, for example the payee account id.
- merchant_reference: your own reference for this request.
- channel: web, mobile_app, desktop or extension.
- risk_level: low, normal, high or critical.
Returns session_id, challenge, expires_at and push_delivery_status.
const start = await tapsign.post('/payment/approval/start', { client_key_id: process.env.TAPSIGN_CLIENT_KEY_ID, device_ref: user.tapsignDeviceRef, operation: 'withdraw', amount_minor: 1250, currency: 'USD', target_ref: payout.accountId, merchant_reference: payout.id, channel: 'mobile_app', risk_level: 'high', });2. Wait for the phone
GET /payment/approval/status?client_key_id=...&session_id=...
Poll from your server. Status is pending, approved, denied or expired. If push_delivery_status is not sent, tell the user to open the app on their phone.
3. Confirm and act (server)
POST /payment/approval/consume
Send the same operation, amount_minor, currency and target_ref you started with. TapSign refuses the approval if any of them differ.
Move the money only when this returns HTTP 200, and inside the same database transaction if you can.
await tapsign.post('/payment/approval/consume', { client_key_id: process.env.TAPSIGN_CLIENT_KEY_ID, session_id: req.body.sessionId, operation: 'withdraw', amount_minor: payout.amountMinor, currency: payout.currency, target_ref: payout.accountId, }); await ledger.releasePayout(payout.id); // only after HTTP 200Approving inside your own app
When the user is already in your app on the enrolled phone, return session_id and challenge to the app and approve there with the SDK. One fingerprint, no switching apps. See Mobile apps.
Card protection
For card issuers and banks. The cardholder turns protection on for a card in the TapSign app. From then on, a card payment they did not approve on their phone does not go through.
What the cardholder sees
- A notification the moment the card is used: "Was this you?"
- They approve with a fingerprint or Face ID, then retry the payment, which now goes through.
- Merchants they trust can be added to an allow list, so everyday payments are not interrupted.
- A guardian, such as a parent, can be named to approve on their behalf.
Connect your card programme
Card protection runs on your card processor's real-time authorisation. Stripe Issuing is supported today.
- Point your real-time authorisation webhook to POST /issuing/authorization on your TapSign server.
- TapSign answers within the processor's time limit with approved true or false.
- Protection is part of the Card protection plan. Contact us to enable it for your workspace.
Cardholder API
For your own banking app, the same controls are available through the API.
- POST /card-protector/enroll: add a card.
- POST /card-protector/toggle: turn protection on or off.
- GET /card-protector/cards: list protected cards.
- POST /card-protector/exempt: allow a trusted merchant.
- POST /card-protector/guardian: name a guardian.
Enterprise sign-in
Protect your staff and admin accounts. Passwords can be phished; a TapSign approval cannot, because it is a hardware signature bound to one sign-in on one website.
What you get
- TapSign Passkey. Sign in to the portal with one fingerprint and no password: check that your phone and your screen show the same number, then approve. Choose which computers may sign in.
- Single sign-on. Connect your identity provider with SAML or OpenID Connect, and TapSign adds the phone approval to every SSO sign-in.
- Staff management. Invite staff, give company admins only the permissions they need, and see who did what.
- One approval phone per workspace. Choose it in the portal so admin sign-ins always reach the right person.
Set up
- Sign in to the Enterprise portal and enrol your phone.
- Settings, Approval device: promote the phone that approves admin sign-ins.
- Federation: add your identity provider (SAML or OpenID Connect).
- Staff: invite your team. Each person enrols their own phone from the invitation.
On-premises
The same portal runs inside your own network. Your TapSign server, database and keys stay on your infrastructure, and a signed licence ties the install to your address. Contact us for the on-premises bundle.
Mobile apps
Put TapSign inside your own iOS and Android app. Your users enrol and approve without leaving it: one button, one fingerprint or Face ID.
Install
- React Native: @tapsign/react-native-sdk.
- Native Android: the TapSign Android SDK (minimum Android 9, API 28).
- Native iOS: the TapSign iOS SDK (iOS 15.1 or later).
Download the SDK packages from the Enterprise portal, Downloads.
iOS setup
Add these two items, or the app cannot use TapSign on iPhone.
- Info.plist: NSFaceIDUsageDescription, with a sentence such as "Uses Face ID to approve sign-ins and payments."
- Signing and Capabilities: add App Attest, with the environment set to production.
Then in the Enterprise portal, open your connector and add your iOS app id under iOS apps, in the form TEAMID.com.yourcompany.app.
Enrol this phone
Your server starts enrolment (POST /device/bootstrap/token) and returns the values to the app. The app registers the phone, and your server saves the device TapSign reports (POST /device/bootstrap/resolve).
import { TapSignSDK } from '@tapsign/react-native-sdk'; const s = await api.post('/tapsign/enrollment/start'); // your server await TapSignSDK.configure(s.apiBaseUrl); await TapSignSDK.registerDevice(s.clientKeyId, s.bootstrapToken, { bootstrapSessionId: s.sessionId, }); await api.post('/tapsign/enrollment/complete', { sessionId: s.sessionId });Approve inside the app
When your server starts an approval, return session_id and challenge to the app.
// payments and actions await TapSignSDK.respondPaymentApproval(clientKeyId, sessionId, challenge, 'approved', { biometricReason: 'Approve this withdrawal', }); // sign-in await TapSignSDK.otpLoginRespond(clientKeyId, sessionId, challenge, 'approved');Then call your protected route. Your server confirms with TapSign as usual.
Approvals started on your website
If the same user signs in on your website, the approval arrives in your app. Listen for it and show the request.
TapSignSDK.addIncomingApprovalListener(({ sessionId }) => openApprovalCard(sessionId)); const first = await TapSignSDK.getInitialApproval(); // the push that opened the app if (first?.sessionId) openApprovalCard(first.sessionId);Rules
- An app never shows an enrolment QR code. Enrolment happens inside the app.
- A website never includes the mobile SDK.
Errors and fixes
The messages you are most likely to see while integrating, exactly as TapSign returns them, and what to do.
Connecting your server
401 missing connector auth headers
The request was not signed. Send every call through the TapSign server client (ask your agent for the node-client template).
401 invalid connector signature
The signature does not match. Check that TAPSIGN_CONNECTOR_ID and TAPSIGN_CONNECTOR_PRIVATE_KEY_B64 come from the same connector bundle, and that the body you send is the body you signed.
401 invalid or reused connector nonce
Each call needs a fresh nonce from TapSign. The server client fetches one per call; do not cache or reuse it.
401 connector timestamp outside allowed skew
Your server clock is wrong. Turn on automatic time sync (NTP).
403 connector source ip is not permitted
Your server's public IP address is not on the connector's allow list. Enterprise portal, Settings, Server connector: edit the connector and add the address.
403 connector is not active
The connector was suspended or revoked. Reactivate it in the portal, or issue a new bundle.
Confirming an approval
409 auth session is not approved (or payment approval is not approved)
The user has not approved yet, or declined. Keep waiting, or ask them to try again. Never act on this.
410 auth session expired (or payment approval expired)
The approval timed out before it was confirmed. Start a new one.
409 auth session already consumed (or payment approval already consumed)
This approval was already used once. Each approval works for one action only. Start a new one.
409 payment approval amount mismatch
You confirmed with a different amount than the one the user approved. The same applies to operation, currency, target_ref and request_context mismatch. Confirm with exactly the values you started with.
Sign-in and devices
503 TapSign approval is unavailable; login was denied
TapSign could not be reached, or the workspace has several phones and none is chosen for admin sign-in. Refuse the sign-in and let the user retry. For admin sign-in, choose the approval phone in the portal (Settings, Approval device).
this iPhone has not proved its Secure Enclave claim
Your iOS app needs the App Attest capability (environment production), and your iOS app id must be listed on your connector (iOS apps). Then enrol the phone again.
The iPhone app closes when TapSign starts
The app's Info.plist has no NSFaceIDUsageDescription. Add it and rebuild.
No approval arrives on the phone
Check that the user enrolled this phone and that notifications are allowed for your app, then ask them to open the app. Pending approvals also load when the app opens.
Check your integration
Ask your AI agent to run tapsign_verify, or run the command line (see AI tools and VS Code):
tapsign verify .It exits with code 2 on any BLOCK, so you can run it in CI.
Still stuck?
Contact us with the error message, the time it happened and your workspace key. Never send your private key.
AI tools and VS Code
Let your AI coding agent add TapSign for you. The TapSign MCP server knows the correct flow for your stack, writes the code and checks it.
Install in VS Code
- Open VS Code, go to Extensions and install PG Memory Bank (publisher PG Digital Global).
- Open the Command Palette, type TapSign MCP and run the set-up command it finds.
- Choose Reload Window. Then ask your AI chat: "Run tapsign_start on this project."
From the terminal:
code --install-extension pgdigitalglobal.narrate-vscode-extensionCursor, Claude Code and Claude Desktop
Run the same setup command in VS Code once and choose "Copy config for other clients". Paste the copied block into your editor's MCP settings and restart it.
What to ask your agent
Run tapsign_start on this project. Add TapSign approval to sign-in and payments, then run tapsign_verify and fix every BLOCK.Tools your agent gets
- tapsign_start: detects your app, website and server, and gives the plan for each.
- tapsign_template: copy-paste code for your stack, including node-client, the signed server client.
- tapsign_verify: finds unsafe integrations. Exit code 2 means a BLOCK.
The tapsign command line
The same tools without an AI agent. The extension installs them on your machine; add this alias once:
alias tapsign='node ~/.pg-cli/mcp/dist/cli.js' tapsign detect . # app, website or server, and the flow for each tapsign plan . # step-by-step plan tapsign verify . # run it in CI tapsign template node-client # the signed server clientWhat else the extension checks
PG Memory Bank, our VS Code extension, also checks your whole project before you ship, on your own machine:
- Security scan: injection, XSS, SSRF, weak cryptography, and gaps in sign-in and permissions.
- Dependency check: known vulnerabilities in your packages. A high-severity advisory stops the release.
- Secrets guard: a password or key cannot be committed.
- Frontend checks: keyboard access, media, spacing, headers and file size limits.
- Project memory: your project's decisions and notes stay with the code, and AI assistants follow them.
No account and no payment needed. Run the checks from the Command Palette (type PG) or from the terminal:
pg install # once per project pg start # open a session for this project pg self-check # run every checkPrivacy
The MCP server and the command line run on your machine. Your code is not uploaded.
What TapSign protects
The risks TapSign stops
Attackers go after passwords, inboxes, cards and trust. TapSign puts the final decision on the phone in your hand, so a stolen password, a fake email or a cloned voice is not enough.
Logins and passwords
A stolen password is no longer enough.
Phishing pages, leaked password lists and kits that steal one-time codes hand attackers the keys to an account. A code can be read out over the phone, forwarded or captured by a fake page.
What TapSign stops- Sign-ins with a stolen, leaked or reused password
- Phishing pages that capture a one-time code and replay it
- An approval copied or reused for a different sign-in
TapSign Passkey
Sign in with one fingerprint. No password.
TapSign Passkey is built in: the phone you already use for TapSign is your passkey. Type your email, check that your phone and your screen show the same number, and approve with your face or fingerprint. No password, no QR code to scan. The key stays in your phone’s security chip and is never synced or copied. Choose the computers that may sign in; for a new one, unlock it from your phone, sign in, add it, and lock again. TapSign Passkey only saves you typing a password; it is not what keeps you safe. Sign in with your password and your phone still has to approve, and the session still works only in the browser that signed in.
What TapSign Passkey stops- A stolen or guessed password: there is none to steal
- Strangers who know your email: a computer you did not allow cannot even send you a request
- Approving a sign-in you did not start: its number will not match your screen
- A stolen session or cookie: it works only in the browser that signed in, so on any other computer it opens nothing
- A captured request sent again: each request works once
Email and invoice fraud
Fake emails get caught before anyone acts.
Business email compromise is one of the costliest frauds there is. A lookalike address or a taken-over mailbox asks for a payment, a password or new bank details, and it reads exactly like the real person.
What TapSign stops- Emails sent in your name from a lookalike or hijacked account
- Invoice fraud and changed bank details
- Messages altered after they were signed and sent
Cards and payments
A copied card cannot pay on its own.
Card numbers leak through data breaches, skimmers and fake checkout pages. Criminals test them with small payments, then spend fast before anyone notices.
What TapSign stops- Card payments the cardholder did not approve on their phone
- Large transfers without a fingerprint or Face ID
- Payments pushed through from a taken-over account
Deepfakes and cloned voices
A cloned face or voice cannot approve anything.
AI can copy a face and a voice from a few seconds of video. Fraudsters use it on video calls and voice notes to pose as a manager or a family member and ask for money, fast.
What TapSign stops- Money requests from a fake video call or voice note
- Edited or re-filmed photos and videos passed off as real
- Urgent instructions that skip the real person’s approval
Identity verification
Account takeover stops at the front door.
Attackers pose as the account owner to reset a password, move a phone number or recover an account. Help desks and recovery emails are where most takeovers begin.
What TapSign stops- Password resets and account recovery by an impostor
- A new phone added without the owner’s approval
- Sign-ups made with someone else’s identity
Admin actions and code
One stolen session cannot wreck your business.
Once inside, an attacker or a rogue insider can export customer data, change payout accounts or push code to production. Most systems only checked the password at the door.
What TapSign stops- Data exports and deletions nobody approved
- Changes to payout accounts and admin roles
- Code pushed to production without the developer’s tap
Verified media and proof
Real photos and videos with trusted proof.
TapSign signs the file’s fingerprint with a key that never leaves your phone. Share the file with its proof so anyone can check it is unchanged.
What TapSign provides- A cryptographic signature tied to your phone
- Proof of when the file was signed and by which phone
- Anyone can check the file has not been changed
Private documents
Your documents. Only for the right people.
Send sensitive files to the people you choose. Each file is sealed on your phone and opens only for them. Not even TapSign can open it.
Key features- End-to-end encrypted before it leaves your phone
- Shared only with the people you choose
- Every opening needs the recipient’s fingerprint
Start protecting
Start with the action you worry about most.
Protect sign-in first, then add payments, email and admin actions when you are ready. Your team keeps the tools it already uses.
