Verify 2X privacy policy

Last updated 11 October 2026.

Who we are

Erp2X is a business management and online store platform for businesses in Sri Lanka. Verify 2X is our official two-factor authentication companion mobile app for Android and iPhone. This privacy policy explains what information Verify 2X handles, where it is stored, what is sent to Erp2X servers, and how your privacy is protected. For our website and general platform privacy practices, see our main privacy policy.

What Verify 2X does

Verify 2X delivers identity verification and two-factor authentication (2FA) for Erp2X user accounts. When you sign in to your Erp2X account on the web or admin portal, Verify 2X helps ensure that only you can access your account through two methods:

• Real-time push approvals: Instant notifications sent to your phone with sign-in context (organisation name, application, browser, IP address) and either single-tap approve/deny verification or number-matching verification to guard against accidental approvals and push fatigue.
• Offline one-time passcodes: Standard 6-digit time-based one-time passcodes (RFC 6238 TOTP) generated every 30 seconds, allowing you to sign in securely even without internet access or mobile reception.

Verify 2X works exclusively with Erp2X accounts and requires an active Erp2X user profile.

Data stored only on your phone

Verify 2X is designed to keep sensitive authentication secrets and personal identifiers on your device:

• Hardware-backed encrypted credentials: Your device registration ID (deviceId), secret cryptographic key (deviceSecret), and one-time passcode generator seed (totpSecret) are stored securely using hardware-backed storage on your device (Android Keystore on Android and iOS Keychain on iPhone). Plain browser storage (localStorage) is never used for credentials.
• Backup protection: On Android, app backups (cloud and ADB) are switched off for Verify 2X (allowBackup="false"), so your credentials and secrets cannot be copied out through a backup. On iPhone, secrets are kept in the Keychain and are not readable by other apps.
• Organisation labels: To let you identify your enrolled accounts, the app locally retains your user ID (userId), organisation ID (tenantId), organisation name (tenantName), and account label.
• Biometric data: When you approve a sign-in, the app requests confirmation using your device's fingerprint sensor, face recognition (such as Face ID), or screen lock passcode/PIN. All biometric verification is handled entirely by your phone's operating system (Android BiometricPrompt and iOS LocalAuthentication). Biometric templates never enter the application, never leave your phone's secure hardware enclave, and are never seen by or sent to Erp2X. Verify 2X receives only a status outcome (such as approved, cancelled, or no lock set) from your phone's operating system.

Data sent to Erp2X servers

Verify 2X connects to Erp2X servers solely to register your device and verify sign-in requests. All data transmitted between the app and our servers is encrypted in transit over HTTPS (TLS 1.2+). The specific data transmitted includes:

• Device enrolment: When you add an account using a QR code or 10-digit enrolment code, the app sends the temporary enrolment code, your device model name (such as "Pixel 8" or "iPhone 15"), operating system platform (android or ios), and your Firebase Cloud Messaging push token.
• Push token updates: When your device push token rotates, the app sends the updated push token to keep notification delivery working.
• Sign-in challenge decisions: When you review a sign-in request, the app transmits the challenge request ID (requestId) and your response (such as APPROVE, DENY, or your selected matching number), authenticated using your device ID and device secret header.
• Account unenrolment: When you delete an account from the app, the app notifies the server to revoke the device's registration.
• Security audit logging: When a sign-in challenge is initiated or answered, Erp2X servers log the event timestamp, device ID, user ID, IP address, and outcome (such as approved, denied, or expired) in account audit logs for security tracking and fraud prevention.

Verify 2X does not collect or transmit your real name, email address, phone number, contacts, browsing history, GPS location, financial information, or passwords.

Push notifications

Push notifications are delivered via Google Firebase Cloud Messaging (FCM) on Android and Apple Push Notification service (APNs via FCM) on iPhone. When a sign-in attempt occurs, Erp2X servers send a message through FCM to your phone containing the request ID, organisation name, and sign-in details (such as browser, application, and IP address).

Notification permission is requested when you add an account. If you decline push notifications, you can still use Verify 2X by entering the rotating 6-digit one-time code (TOTP) on your sign-in screen.

Camera usage

Verify 2X requests access to your phone's camera for one purpose only: scanning the enrolment QR code displayed in your Erp2X account security settings. Barcode recognition is performed locally on your device in real time using Google ML Kit on Android and on-device camera processing on iPhone. The camera operates only while the scanner screen is open. No photographs, video recordings, or images are captured, saved, or uploaded from your device. You can also skip camera access completely by typing the 10-digit manual enrolment code.

No advertising, no tracking, and no selling of data

Verify 2X is completely ad-free. We do not sell, rent, trade, or monetize your personal or device data to advertisers, data brokers, or third parties. Verify 2X contains no analytics, telemetry, behavioural tracking, or advertising SDKs. We do not track you across apps or websites.

Retention and deletion

Data stored on your phone remains until you remove the account in Verify 2X or uninstall the app. Removing an account inside the app immediately wipes its encryption keys and secrets from your device's secure storage.

When an account is removed from the app, or when an administrator revokes a device in Erp2X security settings (or resets 2FA for your user profile), the device registration is deactivated on Erp2X servers. If your Erp2X user account is deleted, all associated device registrations are removed. See our data deletion page for information on requesting deletion of your personal data.

Security

We implement strict security practices to keep your authentication credentials safe, including hardware-backed cryptographic key storage, operating system backup exclusion, mandatory device screen lock or biometric verification before approvals, number-matching verification to stop push fatigue attacks, and end-to-end transport encryption (TLS) for all network requests.

Children's privacy

Verify 2X is a business security tool intended for workplace and enterprise users aged 18 and over. It is not directed at children under the age of 18, and we do not knowingly collect information from minors.

Changes to this policy

We may update this privacy policy from time to time to reflect updates to the app or regulatory requirements. Any updates will be published on this page with an updated "Last updated" date.

Contact

If you have any questions or requests regarding this policy or how Verify 2X handles your data, please contact us through our contact page. The rules for using Erp2X services are set out in our Terms and Conditions.