Privacy & Security
Security Features
Overview
Torki offers passkeys, an authenticator app, a list of every signed-in device, and email alerts on some account changes. This article is what each one actually covers.
Passkeys
Passkeys let you sign in with your device's fingerprint or face sensor, or its PIN, and they are phishing-resistant because they are bound to the Torki domain and cannot be replayed elsewhere.
Add one from Settings → Security → Passkeys with + Add Passkey; remove one with the trash icon on its row and confirm with Yes, remove.
Once you have a passkey, signing in with your password asks for the passkey rather than an email code. If you are away from that device, choose Use email code instead on the passkey screen.
Two-factor authentication
Go to Settings → Security and find the Multi-Factor Authentication section. Switch on the toggle next to Authenticator App. Torki shows a QR code (and the same secret in text if your app cannot scan), you enter the 6-digit code from your app and press Verify.
After that, entering your password at sign-in takes you straight to a 6-digit code screen. To turn it off, type a current code into the box and press Disable MFA.
Torki does not issue backup or recovery codes. Before you turn this on, make sure you have a second way in: add a passkey, or confirm you can sign in with Google, Apple or Microsoft.
If you lose your authenticator and have no other sign-in method, email support@torkiai.com from the address on your account.
Active sessions
Go to Settings → Security → Active Sessions. Each row shows the device, when it was last active and the IP address; the session you are using is tagged Current.
To sign out one other device, click the red trash icon on its row. To sign out everywhere, click Log out of all devices at the top of the section and confirm with Log out all — this signs out this device too, so you will need to sign in again.
Email notifications
Torki emails you when:
- your password changes
- your email address changes
- a passkey is added or removed
It does not email you when a new device signs in, and it does not email you when two-factor authentication is turned on or off.
If you are worried about someone else being signed in, check Settings → Security → Active Sessions yourself and use "Log out of all devices".
Verification on sensitive changes
Changing your email address requires two codes: one sent to your current address to prove it is you, then one sent to the new address to prove you own it. Deleting your account from the mobile app also sends a code. Changing your password asks for your current password rather than a code.
On the web, Delete Account is confirmed with two dialogs and no email code. Treat an open session on a shared computer as a real risk and sign out of it.
FAQ
Will Torki tell me if someone signs into my account?
No — there is no new-device email. Check Active Sessions yourself.
I lost my phone with my authenticator on it.
Email support@torkiai.com from the address on the account. There are no recovery codes.
Does "Log out of all devices" sign me out too?
Yes. You will need to sign in again afterwards.