Security

Signing in

Your login rests on passkeys, and every sensitive action asks again.

Passkeys, not passwords

You sign in with a passkey that uses your device's fingerprint, face recognition or screen lock. A passkey only works on Holyheld's own site, so a look-alike page can't capture it.

A second check for what matters

Payments and security changes ask for your passkey, or a code sent to your verified phone, and then your six-digit passcode.

Idle sessions lock

Step away and Holyheld locks. Your passkey opens it again.

Wrong passcodes lock the account

Too many incorrect passcodes lock the account, and only a recovery through Concierge opens it again.

Devices you can see

Account Settings lists every browser signed in to your account and when it last signed in. Remove one and its sessions end.

A record of security events

Sign-ins, lockouts, passkey and passcode changes and account recoveries are listed in Account Settings, newest first.

Team and payment controls

The checks between a stolen login and a payment instruction.

A role for every member

Directors, Assistants, Accountants and Employees each see and do only what their role allows.

Approvals before a payment goes out

A payment a team member requests waits for an approver, who sees its amount, recipient and terms before approving it.

Payee name checks

A UK account is checked against the name you entered. If it doesn't match, you confirm you understand before you can pay it.

Wallets proven before use

A wallet saved as your company's own is verified with a signed message, and a Safe with several owners only once enough of them have signed.

A pause after recovery

For 12 hours after an account recovery, new recipients and security changes are paused, so a hijacked recovery can't redirect payments.

Signed out everywhere

Replacing your passkey or changing your passcode signs out your other sessions.

Card data and PCI DSS

Holyheld's card issuing service is assessed against PCI DSS, the payment card industry's security standard, and validated as compliant.

Recognise genuine Holyheld

Our addresses

The app is at business.holyheld.com and our website at holyheld.com. Check the address before you sign in.

What we never ask for

Holyheld will never ask for your passcode or for a code we text you, by email, chat or phone.

Not sure a message is ours?

Don't use its links. Open the app yourself and ask Concierge.