Setting up recovery

You can generate a recovery code anytime — at signup, a week later, or after a year. It requires touching your hardware key, which proves you are physically present. A compromised browser or AI agent cannot silently generate one for you.

Step 1 — Generate your recovery code

Open your account settings and click Generate recovery code. Tap your hardware key when prompted.

Clavitor will display 48 characters in an 8×6 grid:

xK4mP9  q7nL3R  t8sV2W  aJ6dF1
hY9gB4  nM5cE7  zP2tQ8  vK3rL6

This is the piece you hold. The paired piece — the recovery anchor — is held by Clavitor. Neither one alone is useful; the two are combined to reconstruct the key that unlocks your vault.

The format catches typos. If you ever enter the code and one character is wrong, recovery will refuse before any data is sent.

Step 2 — Save it somewhere you will find it

Print it. Email it to yourself. Save it in a different password manager. Put it in a drawer. Photograph the screen. The recovery code is safe to store digitally — it is useless without a live Zoom call with Clavitor.

Common choices that work fine:

• Print it and put it in your filing cabinet.
• Email it to yourself with a clear subject line.
• Save it in your cloud drive in a folder you will remember.
• Store it on a USB stick that lives in your desk.

What you should not do:

• Do not store the recovery code in Clavitor itself.
• Do not save it on the same hardware key — if the key is lost, both pieces are gone.

Step 3 — Confirm you have it

After Clavitor shows you the code, you must click I have saved this before the recovery anchor activates on our side. If you close the page without confirming, your old recovery code (if any) stays valid. There is no in-between state where you have a code we do not know about, or we have an anchor you cannot pair with.

Step 4 — Choose your verification material

When you need to recover, Clavitor's operator has to confirm you are really you on the Zoom call. We do not ask for a passport or birth certificate — those are easier to forge than your parked car. We do not ask where your parents met, the brand of your first car, or any of the other "security questions" the rest of the industry leans on — those are researchable on social media and leak in every breach. You decide what we use. We never invent a question.

The verification material works by letting the operator demand something only the real you can produce live on the call. Two approaches work:

• Physical proof of possession — point us at a source (a photo album, an unlisted video, a video tour of your living room) and the operator picks an item for you to show. Or pre-declare a specific verifiable fact, like "I have a Toyota with license plate ABC-123, parked outside my window." On the call, you point your camera out the window and the operator reads the plate. Either way, you bring the actual item, live — not a photograph of it. Photos can be edited or generated; an object in your hands or in your view on a moving video cannot. The operator also reads the whole frame, not just the asked-about item — kids, pets, paintings, room layout in the background all count as bonus confirmation if they match your source.
• Knowledge proof — a code phrase only you would know: a line from a personal poem, a sentence you invented, an inside joke, or just any phrase you will remember and an attacker will not. For the security-minded: a long random entropy string you generated yourself and stored separately. You recite or paste it on the call. A human listens, not a regex — a shortened name, a missed accent, a small typo will not trip you up. A different phrase will. The attacker gets one human-judged attempt per call.

You can change this anytime while you have your hardware key. Once you have lost the key, the verification material is locked — that is deliberate. Otherwise a thief could rewrite it before initiating recovery.

The operator will not start by announcing what you chose ("show me your Instagram" / "what is your code phrase?"). They ask you to tell them what you set. You must remember both the category and the content. An attacker who only has your recovery code does not know which category to claim, and a wrong claim ends the call. And once you have identified the category, the operator never commits in advance to a specific item or question — they pick when they see you on the call.

Re-generating a recovery code

If you suspect the recovery code is compromised, or you have lost the paper copy, generate a new one. The new code replaces the old; the old one stops working as soon as you confirm the new one. Tap your hardware key each time you regenerate.

What about Clavitor agents?

Recovery codes are for the hardware key, not for individual agents. Agents have their own enrollment tokens — much shorter-lived and revoked through a different flow. If an agent token is compromised, revoke the agent. The recovery code stays untouched.