One app for iOS and Android
The Ciyora mobile app puts sign-in approvals, access decisions, Ciyora VPN and SOC on-call work on the phone. Everyone gets the same app; what each person sees follows their role.
What the Ciyora mobile app does
Ciyora Verify: the phone approves the sign-in
The app is the second factor for your company sign-ins and for high-risk actions. When someone signs in, the phone asks “Is this you signing in?” and the person types the number shown on the sign-in screen, so a stray tap cannot approve an attacker’s request.
- Push sign-in approvals with number matching; the number is never sent to the phone
- Approval needs a fingerprint or face check and a signature from a device key held in the Secure Enclave or Android Keystore, which never leaves the phone
- Three wrong numbers block the sign-in, as a defence against MFA fatigue
- “No, it’s not me” denies the sign-in and can report it, raising a suspected credential-compromise signal in Ciyora Fortress
- Passkeys and security keys on the phone for step-up on sensitive actions
Approvals wherever the approver is
Managers, application owners and administrators decide access from the phone with the same rules as Ciyora Console. Nobody can approve their own request, and the API enforces every rule; the app only hides what would fail.
- Access requests with the separation-of-duties result; approving despite a conflict needs a written reason
- Just-in-time elevation requests with the policy evaluation, requested duration and justification
- Access reviews: certify or revoke, with a justification required for high-risk access and for every revocation
- Break-glass dual control: one approval per approver, the required number of different people, never the requester
- Denying anything needs a reason, and every decision lands in the hash-chained audit log
My access, in my pocket
Every employee can request access, follow their requests and see what they hold, without opening a laptop.
- Request access from the catalogue with level, duration and reason
- My requests and temporary admin (just-in-time) requests with their status
- My devices and their posture
- Privileged credentials from the vault, revealed only after a passkey step-up
Ciyora VPN on the phone
The same mesh as Ciyora Client, on iOS and Android. Enrol the phone with a key, connect, and reach the company networks that your access policy allows, and nothing else.
- Enrol with a key, connect and disconnect, and remove the device
- Status with the path (direct or relayed), latency and data counters
- Exit node picker and the list of company networks (sites) this phone may reach
- Exit nodes and networks come from the policy the phone receives, so it shows exactly what the policy allows
SOC on call
Analysts and on-call engineers get pages, alerts and incidents on the phone, and responders can act on an incident without waiting to reach a desk.
- On-call pages with escalation, acknowledged from the phone
- Alerts: acknowledge, assign and resolve
- Incidents with a timeline of signals, notes and response actions
- Response actions such as isolating a device or disabling a user, each with a reason, a typed confirmation and a biometric check
- Low-risk changes such as acknowledging an alert or adding a note are queued while offline and sent when the phone reconnects; security decisions never are
Zara on the phone
Ask Zara about your environment from the app. Answers come from your tenant’s data and are rendered as plain, safe text, with suggested questions to start from.
- Suggested questions for the signed-in person
- The same tenant scoping and permissions as Ciyora Console
Built like a security tool
- Company sign-in
- Sign-in with your company identity provider through the system browser, using the authorization code flow with PKCE. The app never sees a password.
- Tokens on this device only
- Tokens are kept per account in the Android Keystore or iOS Keychain, restricted to this device, and refreshed as needed.
- App lock
- Fingerprint or face unlock after a short time away from the app.
- Several accounts and companies
- Up to five accounts on one phone, and a company switcher for people who work across more than one tenant.
- Role-based
- One app for everyone. What each person sees follows their roles: employee, approver, reviewer, break-glass approver, SOC analyst or responder.
- Notifications without secrets
- Push notifications carry only a type and an id. The app fetches the details over the authenticated API, so nothing sensitive appears on the lock screen.
- Light and dark
- Follows the system theme, or set it in the app.
One app, the modules you use. Approvals and Ciyora Verify work with Ciyora Fortress, the VPN with Ciyora VPN, and on-call work with Ciyora Detect. The app shows each person the parts their company uses and their role allows.
See the mobile app in a demo
We demo the app on a sample company as an employee, an approver and an on-call analyst.