> ## Documentation Index
> Fetch the complete documentation index at: https://docs.buburuza.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Onboarding and Security

> How signup works, what KYB and KYC each ask for, and how sign-in, sessions, and recovery are handled.

## Signup

Buburuza is **passwordless by design**. There is no password to choose, reuse, or leak.

<Steps>
  <Step title="Email">
    Enter your email address and confirm the one-time code sent to it. The confirmed address becomes your identity on the platform.
  </Step>

  <Step title="Primary credential">
    Enroll a **passkey** (WebAuthn). Passkeys are bound to the site and cannot be phished or replayed. If your device does not support them, enroll a **TOTP authenticator** as the fallback credential.
  </Step>

  <Step title="Recovery codes">
    You are issued single-use **recovery codes**. They are shown once. They are the only route back into the account if you lose every enrolled credential.
  </Step>
</Steps>

## Verification

Verification is what turns an account into one that can hold and move money. Which flow you take depends on the kind of space.

<Tabs>
  <Tab title="Company space — KYB">
    The company and the people behind it are verified together.

    | Step                   | What happens                                                                                                     |
    | ---------------------- | ---------------------------------------------------------------------------------------------------------------- |
    | Legal and company name | You state the legal representative and the company                                                               |
    | Document checklist     | The platform shows what your country of registration requires                                                    |
    | Hosted verification    | Sumsub runs the check for the company and its associated persons — directors, controllers, and beneficial owners |
    | Payment account        | Provisioned automatically once the verification passes                                                           |
    | Provider agreement     | Some providers require you to accept hosted terms before money movement opens                                    |

    Companies verify at a **tier**. The tier gates what the account may do, and a lighter tier can receive funds while outbound movement stays closed.
  </Tab>

  <Tab title="Personal space — KYC">
    One individual is verified, for themselves.

    | Step                 | What happens                                                    |
    | -------------------- | --------------------------------------------------------------- |
    | Country of residence | You state where you live; this selects the verification profile |
    | Hosted verification  | Sumsub runs the identity check                                  |
    | Payment account      | Provisioned automatically once the verification passes          |

    Your stated country of residence is recorded as given. It is never inferred from your network location, and it does not change if you travel.
  </Tab>
</Tabs>

<Warning>
  Verification is available only for companies registered in the **United States or Canada**, and individuals resident in those countries. Outside them there is no verification profile to run, so onboarding stops at that step.
</Warning>

<Tip>
  Nothing about verification is instant. The decision arrives from the reviewer asynchronously and the dashboard reflects it when it lands. If more is needed, you are told what and asked to resubmit.
</Tip>

## Signing in

| Method                  | When you use it                                                                     |
| ----------------------- | ----------------------------------------------------------------------------------- |
| **Passkey**             | Everyday sign-in. One touch, no codes to type                                       |
| **Email one-time code** | On a new device, or when a passkey is not available                                 |
| **TOTP**                | As the enrolled fallback credential, or as an optional extra step you can switch on |
| **Recovery code**       | Last resort, when every other credential is gone. Each code works once              |

You can review the sign-in methods on your account at any time and add or remove passkeys as you change devices.

## Sessions and devices

* Every sign-in creates a **session** you can see and revoke — one at a time or all at once.
* Access tokens are short-lived and refresh quietly while you are using the app.
* Revoking everywhere ends every active session immediately, including the one you are using.

## Step-up

Some actions ask you to re-confirm your identity even though you are already signed in — changing security settings, for example. This is a **step-up challenge**: you satisfy it with the credential you already have, and it applies to that action only.

## What is not offered

The platform does not have, and does not simulate, any of the following. If you have seen them described elsewhere, that description was wrong:

* SMS as an authentication factor
* Voice or face recognition
* Social recovery through trusted contacts
* A one-touch account freeze, travel mode, or emergency contacts

Account safety rests on phishing-resistant credentials, short sessions you can revoke, and verification gating on money movement.

## Related

<CardGroup cols={1}>
  <Card title="Compliance and security" icon="shield-halved" href="/compliance-security">
    Verification tiers, monitoring, and reporting obligations.
  </Card>
</CardGroup>


## Related topics

- [Compliance and Security](/compliance-security.md)
- [Introduction](/introduction.md)
- [Legal and Regulatory](/legal.md)
- [Buburuza Documentation](/index.md)
- [Quickstart](/quickstart.md)