At Bron, your security is our top priority. We use a multi-layered MPC-based system to protect your account and assets. But access issues happen — lost devices, forgotten passkeys, or compromised shards.
Access on Bron works on two independent levels, and each has its own recovery:
Level 1 — Signing in to your account. Your passkey (and 2FA, if enabled) protects access to the Bron app: workspaces, balances, settings.
Level 2 — Signing transactions. Transactions are signed with key material stored on your trusted device. Signing in alone is never enough to move funds.
Recovering one level does not automatically restore the other — so compromising one of them is never enough to take over your assets.
1. Recovering access to your account (lost passkeys and/or 2FA)
If you’ve lost the passkeys you use to sign in, start recovery from the Login page → Use another account → Lost access. There are three ways, depending on what you have set up — see the Account Recovery: Step-by-Step Guide:
FaceScan — the fastest way. Verify your identity with a face scan; if any of your workspaces has ever moved $100 or more, access is restored automatically after a 2-day security delay, otherwise right away.
Guardians — enter recovery codes from 2 of your Guardians, then a 2-day security delay runs and access is restored automatically.
Self-recovery — if neither FaceScan nor Guardians can verify you, you can still recover on your own after an extended delay: 30 days if any of your workspaces has ever moved $100 or more (14 days with a valid 2FA code), otherwise 2 days.
⚠️ Newly added Guardians or a newly set up FaceScan must first pass a 30-day security delay before they can be used for recovery. For a Guardian the 30 days start when that person accepts the invite; for FaceScan, when the enrolment is completed. Until then, the method is shown as unavailable, with the time remaining until it becomes available.
If you have 2FA set up, you will be asked to enter the code or mark it as lost; a lost 2FA extends the delay (for example, from 2 days to 7).
2. Restoring signing (lost or compromised trusted device)
If the device you use to sign transactions is lost, reset, stolen, or compromised — or you have changed its biometrics: re-enrolling Face ID, Touch ID, or Windows Hello invalidates the key shards stored on the device and removes its trust — restore signing on a new device: install the Bron desktop or mobile app → Devices Management → Trust this device. There are four options, and Device Management shows you only the ones your account is eligible for:
Approval from another trusted device — if you (or a teammate) still have a working trusted device, no recovery is needed: simply approve the request from that device. The request expires after 2 days if nobody approves it, so a device you have already wiped or lost will never complete it.
FaceScan — verify your identity with a face scan; signing is restored after a 48-hour security delay. Offered only if FaceScan is already enrolled and the enrolment is more than 30 days old.
Guardians — enter recovery codes from 2 of your Guardians; signing is restored after a 48-hour security delay. Offered only if at least 2 Guardians accepted their invitation more than 30 days ago.
Self-recovery — no FaceScan or Guardians available: a 30-day security delay applies. Always available, so this is what remains if you never set either of them up.
⚠️ If you have no FaceScan and no Guardians, self-recovery and its 30 days are your only route. Setting them up now will not shorten it — each needs its own 30-day security delay before it can be used, so neither would be ready sooner. Start self-recovery immediately and set them up alongside it, so that next time the wait is 48 hours. Throughout the delay you keep full access to your account and balances; only signing transactions is on hold.
⚠️ Any of the three recovery options (unlike approval from another device) removes all other trusted devices — after recovery, only the new device can sign. The 30-day security delay for newly added Guardians or FaceScan applies here as well — for a Guardian it starts when that person accepts the invite.
The 2-day cool-down that follows signing in on a new device or browser is a different thing, and it does not hold any of this up: you can request approval from another trusted device, and start any recovery method, while it is running — see Log In to Bron.
Running an MPC Hot Signer?
If an MPC Hot Signer loses access to its shards — for example its KMS key was deleted — do not use the recovery options above. Your accounts are not locked and your other devices keep signing normally; an Owner with access to the shards simply re-shares them into a freshly deployed container, with no security delay. Recovery would remove all your other trusted devices for nothing.
Need help?
Each recovery flow is tailored to balance security and ease of access. If you’re unsure which method to use, or if your situation doesn’t match the above, contact our support team via messenger on the Bron platform, Bron Help Center or by email support@bron.org — we’ll guide you through the safest way to restore access.
📅 Questions about how this works for your team? Book a call with our product team