Frequently asked questions
Short answers to the questions we hear most. Something missing? Write to support@bisotun.app.
The basics
What is Bisotun Wallet?
A free Android app that keeps verified digital cards: facts about you that an organization has checked and digitally signed. When a website asks for one of those facts, you see the request, decide, and share only what it asks for. The website can check that the information is genuine.
Why would I need it?
To stop sending ID scans, certificates and personal details to every service that asks, and to stop creating a new password for every website. You get a fact verified once, keep the card, and prove it wherever it is needed.
What can I put in it?
Today your wallet holds its account card, created automatically when you set it up. A verified email address card is coming soon. Beyond that, any organization can issue its own cards on Bisotun, for example a university diploma, a membership or an employment card. None of those exist yet; they appear when organizations start issuing them.
Where can I use it?
On websites and services that support Bisotun. Today you can try the demo: log in to a sample service with your wallet, no password. Your own My Bisotun account page works the same way. The demo's email scenario needs the verified email address card, which is coming soon. We do not list other services until they actually support Bisotun.
How does a service know my card is genuine?
The issuer signs each card with its secret key. The service checks the signature against the issuer's public key, which is published in Bisotun's signed list of issuers. A forged or altered card fails the check. The check also shows that the card is used from the wallet it was issued to, unlocked with the right PIN.
What do I have to reveal?
Only what the service asks for and you approve. In addition, the service learns which organization issued the card and in which week the card was issued and expires. It does not see your other cards, other items on the same card, or your PIN. See an example.
How is this better than uploading an ID or creating another account?
An upload gives away a full document, which is then stored in yet another system and checked by hand. A new account means another password. With Bisotun the service gets only the facts it needs, already verified, and you log in by approving a request.
How can an organization use it?
As an issuer, it gives people signed cards; as a verifier, it asks for cards and checks them. Websites integrate a widget and a signed server request. See For issuers, For verifiers and Developer integration.
Using the wallet
Which phones are supported?
Android phones running Android 8.0 or newer. Download the app from our download page. An iOS version is planned but has no date yet, and the app is not on Google Play yet.
Does it cost anything?
No, Bisotun Wallet is free.
Do I need an internet connection?
Yes, every time you add or share a card. Offline or NFC use is not supported.
How do I log in to a website with it?
On a computer: choose "Log in with Bisotun", scan the QR code with the app and tap Share. On your phone: tap the button on the website, the app opens, you tap Share and return to the website.
What if a website asks for a card I do not have?
The app tells you and, where possible, shows you how to get it. Then it continues with the request.
Can I use Bisotun Wallet on more than one phone?
Yes. Each phone is a separate wallet with its own cards; add your cards to each. A second phone is a useful spare.
Why do cards expire?
The issuer decides how long a card is valid, depending on how quickly the fact can change. The app warns you before a card expires, and you can get a fresh one from the issuer.
Can I sign documents with it?
Not yet. Signing statements with your cards is coming later.
Privacy
Can Bisotun see my cards?
No. Your cards are stored only on your phone. There is no central database of cards and no cloud copy.
Can Bisotun see what I share?
Partly, and briefly. Bisotun's session server verifies each proof for the website, so it handles the values you share; it keeps the result in memory for up to five minutes for the website to collect and keeps no record. Our keyshare server records when your wallet is used, not what you share or with whom.
Does the issuer learn where I use my card?
No. Showing a card does not contact the organization that issued it.
Can services track me across websites?
Not through the cryptography: each proof is freshly randomized. But the values you share can identify you: an email address is the same everywhere, and your wallet's account ID is the same towards every service that asks for it.
Is it anonymous?
No. Bisotun lets you share less, but what you share can identify you.
Where can I read the privacy policy?
In our privacy policy. It explains exactly what our servers store and for how long.
Security and recovery
What if I lose my phone?
Nobody can use your cards without your PIN, which our server checks and limits after 3 wrong attempts. Your cards are not backed up anywhere: on a new phone you set up the wallet again and get your cards again from their issuers. Remote blocking with a recovery email address is coming soon.
What if I forget my PIN?
We do not have a copy of it. Choose "I forgot my PIN" in the app, set up your wallet again and get your cards again.
Can I unlock the app with my fingerprint?
Yes, optionally. Biometrics only unlock the app screen; sharing and receiving cards still require your PIN.
How do I know who is asking for my data?
The app shows each requester by its web address. Bisotun does not verify organization names yet, so every requester is marked as not known to Bisotun. Check the address before you share, and decline if in doubt.
How do I delete my data?
Choose "Delete all data" in the app's Settings; cards you receive from issuers can also be deleted one by one. To delete your wallet account on our server, use My Bisotun: this blocks the wallet immediately and removes the remaining records after 30 days.
How do I report a security problem?
Write to security@bisotun.app.
Organizations
How do we become an issuer?
Contact support@bisotun.app. Together we define your card, add it to Bisotun's signed list of card types and register your back end to issue it. See For issuers.
How do we accept Bisotun cards?
Ask for a requestor registration at support@bisotun.app, add the widget to your site and a few endpoints to your server. See For verifiers and the developer guide.
Which organizations already use Bisotun?
Bisotun is new, and we will name organizations only once they actually issue or accept cards.
Is Bisotun certified or legally recognized?
We do not claim any certification, audit or legal status. Whether a Bisotun check meets a specific legal requirement depends on your sector and the issuer of the card.
Still have a question?