Security overview
Not every capability described on this wiki is available today.
Quick answer
Mitra OS protects members with passwordless device-bound sign-in, a fresh biometric confirmation for sensitive actions, AI that only reads and drafts, and audit logging.
Summary
Security is built into how the platform works. Sign-in uses passkeys, consequential actions need your confirmation, language-model calls are limited and grounded in live data, and failures in one domain are isolated from the others.
Key takeaways
- Sign-in is passwordless and tied to your device.
- Money, health data and irreversible bookings need a fresh biometric confirmation.
- Language-model calls read and draft only, are grounded in live data and are audit-logged.
- A failure in one domain does not spread to others.
Principles
- No shared secrets. There is no password to phish. See Passkeys.
- Confirm what matters. See Step-up confirmation.
- Constrain the AI. See AI safety and auditability.
- Isolate failures. Each domain fails on its own without taking the rest down.
Related reading
Privacy explains where the legal terms live. Identity explains how verified identity ties these together.
Frequently asked questions
People also ask
- What is a passkey? (Passkeys)
- Why are passkeys safer than passwords? (Passkeys)
- What if I lose my device? (Passkeys)
- When does Mitra ask me to confirm? (Step-up confirmation)
- Is being signed in enough? (Step-up confirmation)
Related topics
feature Passkeys Mitra OS uses passkeys for passwordless, device-bound sign-in with the Secure Enclave on iOS, Android Keystore on Android and WebAuthn on the web. feature Step-up confirmation Why Mitra OS asks for a fresh biometric confirmation before money, health data or irreversible bookings, even if you are already signed in. feature AI safety and auditability How Mitra OS limits what its language-model calls can do: read and draft only, grounded in live data, logged for audit, with failures isolated. guide Privacy Where to find the Mitra OS Privacy Policy, how privacy relates to the security design, and who to contact with privacy questions.