Onboarding and Security

How signup works, what KYB and KYC each ask for, and how sign-in, sessions, and recovery are handled.

Signup

Buburuza is passwordless by design. There is no password to choose, reuse, or leak.

1. Email

   Enter your email address and confirm the one-time code sent to it. The confirmed address becomes your identity on the platform.

2. Primary credential

   Enroll a passkey (WebAuthn). Passkeys are bound to the site and cannot be phished or replayed. If your device does not support them, enroll a TOTP authenticator as the fallback credential.

3. Recovery codes

   You are issued single-use recovery codes. They are shown once. They are the only route back into the account if you lose every enrolled credential.

Verification

Verification is what turns an account into one that can hold and move money. Which flow you take depends on the kind of space.

Company space — KYB

The company and the people behind it are verified together.

Step	What happens
Legal and company name	You state the legal representative and the company
Document checklist	The platform shows what your country of registration requires
Hosted verification	Sumsub runs the check for the company and its associated persons — directors, controllers, and beneficial owners
Payment account	Provisioned automatically once the verification passes
Provider agreement	Some providers require you to accept hosted terms before money movement opens

Companies verify at a tier. The tier gates what the account may do, and a lighter tier can receive funds while outbound movement stays closed.

Personal space — KYC

One individual is verified, for themselves.

Step	What happens
Country of residence	You state where you live; this selects the verification profile
Hosted verification	Sumsub runs the identity check
Payment account	Provisioned automatically once the verification passes

Your stated country of residence is recorded as given. It is never inferred from your network location, and it does not change if you travel.

Verification is available only for companies registered in the United States or Canada, and individuals resident in those countries. Outside them there is no verification profile to run, so onboarding stops at that step.

Nothing about verification is instant. The decision arrives from the reviewer asynchronously and the dashboard reflects it when it lands. If more is needed, you are told what and asked to resubmit.

Signing in

Method	When you use it
Passkey	Everyday sign-in. One touch, no codes to type
Email one-time code	On a new device, or when a passkey is not available
TOTP	As the enrolled fallback credential, or as an optional extra step you can switch on
Recovery code	Last resort, when every other credential is gone. Each code works once

You can review the sign-in methods on your account at any time and add or remove passkeys as you change devices.

Sessions and devices

• Every sign-in creates a session you can see and revoke — one at a time or all at once.
• Access tokens are short-lived and refresh quietly while you are using the app.
• Revoking everywhere ends every active session immediately, including the one you are using.

Step-up

Some actions ask you to re-confirm your identity even though you are already signed in — changing security settings, for example. This is a step-up challenge: you satisfy it with the credential you already have, and it applies to that action only.

What is not offered

The platform does not have, and does not simulate, any of the following. If you have seen them described elsewhere, that description was wrong:

• SMS as an authentication factor
• Voice or face recognition
• Social recovery through trusted contacts
• A one-touch account freeze, travel mode, or emergency contacts

Account safety rests on phishing-resistant credentials, short sessions you can revoke, and verification gating on money movement.

Related

Compliance and security

Verification tiers, monitoring, and reporting obligations.