Devices
Link your PulsVault mobile app as a trusted device, choose how long trust lasts, review every browser and phone with access to your account, and revoke any you no longer trust.
Account → Devices is where you link your PulsVault mobile app to your account, review every browser and phone that can reach your vault, and decide how long that access lasts. A linked mobile becomes a trusted device: it can approve a browser's request to unlock your vault with a tap, so you don't have to re-enter your Access Key each time.
How a device becomes trusted#
There are two paths, and neither of them is "sign in successfully". Signing in never establishes trust on its own.
- Mobile signup — setting up the mobile app as a new account trusts that device as part of the key ceremony.
- QR pairing — from an unlocked browser, generate a pairing code and scan it with your phone. Scanning only registers the phone; trust is created by the separate approval step below.
Linking your mobile app#
Pairing a phone runs as a short three-step wizard — choose Link Device on the Devices page.
Linking works by wrapping your vault key for the new phone, which is only possible while your keys are in memory. If your vault is locked, the wizard shows an Unlock Vault prompt first — unlock, then continue.
- Get the app. Install PulsVault on your iOS or Android phone.
- Scan the QR code. The console generates a pairing QR in your browser. In the app, choose Link Browser Session and scan it (or type the setup code shown below the QR if you can't scan). The pairing code is short-lived — if it expires, choose Regenerate to start over.
- Approve the device. After the phone scans and you sign in on it, an approval prompt appears in the browser showing the device name and its location. Choose Approve to link it, or Deny to reject the request. Approving asks for your account password again, because it hands the phone a key to your vault.
On approval you'll see Mobile App Linked Successfully, and the phone is now a trusted device for your account.
When you approve, PulsVault wraps your vault master key for that specific device's public key (RSA-OAEP-2048) so the phone can decrypt your vault on its own. The key exchange happens between your browser and the phone — the server relays only the wrapped (encrypted) key and never sees the raw key. Only ever approve a device you are physically holding. See Device trust for the full model.
One trusted mobile per account#
PulsVault allows a single trusted mobile at a time. If one is already linked, the wizard tells you the limit is reached and points you to Manage trusted devices — revoke the existing phone first, then link the new one. This limit is enforced by the server as well as the interface, so a second phone can't slip through.
Managing trusted devices#
Below the wizard, the same page lists everything with access to your account as one list. A device's state is a column in that list rather than a section of its own, so you can compare every device in a single pass — which one lapses first, which one is somewhere you don't recognise.
| Filter | What it shows |
|---|---|
| All | Every device on the account, ordered by what needs you first, with revoked ones last. |
| Trusted | Devices that can unlock your vault right now. |
| Needs action | A phone waiting for your approval, and any device that signed in but was never paired. |
| Revoked | Devices whose trust has been revoked, with when each was revoked. |
Each row shows the device name, its status, when it was last used, and how much of its trust window is left. Select a row to expand it for the rest — type, OS or app version, location, IP address, when trust was established and how — together with the actions for that device.
| Status | Means |
|---|---|
| Trusted | Can unlock your vault and approve requests. |
| Expiring soon | Trust lapses within a week unless the device is used or extended. |
| Trust lapsed | The window ran out. The device has to be paired again. |
| Awaiting approval | Scanned your QR and is waiting for you to approve it. |
| Not paired | Signed in, but trust was never established — no vault access. |
| Revoked | Access was removed. |
Your current device is chipped This device beside its name and can't be revoked from itself —
you'd lock yourself out of the session you're using.
Approving a phone#
A phone that has scanned your QR appears in a band at the very top of the page, above everything else, because it is the only thing on this page with a deadline. Choose Approve to share your vault key with it, or Deny to reject it.
Your vault must be unlocked to approve, since approving wraps a key that exists only in memory while the vault is open. The band says so when it is locked. Approving also asks for your account password, so an unlocked browser left open is not enough to add a phone.
Revoking a device#
To remove a device's access, expand its row and choose Revoke trust — or Remove device, for one that was never trusted — then confirm. Revocation is immediate: the device loses its wrapped copy of the vault key and can no longer unlock your vault. Revoking one device never affects any other.
Because the trusted mobile can approve browser unlocks, revoke it right away if you lose the phone, sell it, or upgrade. Revoking also frees the one-mobile slot so you can link a replacement.
How long trust lasts#
Trust is not permanent, and the window is a dormancy timeout rather than a countdown from the day you paired: it moves forward every time you use the device. A phone you use weekly stays trusted indefinitely; one you stop using lapses.
Choose your own window — from 1 day to 1 year — in the Trust duration card at the top of the page. If your organization has set a ceiling, longer options are still listed but disabled, and the card names the policy that capped them so you know who to ask.
You will not be caught out silently. A device drifting toward the end of its window gets a notification a week ahead and a final one the day before, and both clear the moment you use the device. A device close to lapsing also shows an Extend button in its row, which pushes the window out by up to one full window. This matters most for a phone: re-pairing one needs a signed-in browser, so letting a phone lapse while you are away from your desk is the awkward case worth avoiding.
How trusted-device unlock works#
Once a phone is trusted, unlocking a browser is a two-party handshake instead of a manual Access Key entry:
- Your browser asks to unlock and receives a number match to display.
- Your trusted phone is notified and asks you to type that number — it is not sent to the phone — then confirms with your device biometric.
- The phone re-encrypts your vault key just for that browser session and sends it back; the browser opens it and your vault unlocks.
The number you type defeats a request you didn't start, biometrics protect the key on the phone, and the server only relays encrypted material — it never learns your vault key. The deeper security walkthrough lives in Trusted-device unlock.
Device trust rests on keys held on the devices themselves. PulsVault relays sealed payloads between your devices and cannot read them, so "trusted" is not a flag an attacker could flip server-side.
Mobile app unlock settings#
Below the device list, the Mobile app unlock panel shows how your linked phone unlocks the vault — the Unlock method (PIN code, master password, or biometrics), whether a PIN is set, and whether Face ID / Touch ID are on. These are read-only here; change them in the mobile app itself. The panel only appears once a phone has reported its settings.
Limits by plan#
The number of trusted devices per account varies by plan — see Plan comparison & limits. The one-trusted-mobile rule applies on every plan.
Related#
- Device trust — what makes a device trusted and what that grants
- Trusted-device unlock — the security model behind mobile-approved unlocks
- Active sessions — who is signed in, which is a different question
- Plan comparison & limits — device counts per plan