Tumaini Trust · for organisations
Help people know when a communication really comes from you.
Criminals copy your name, your logo and your voice. Tumaini Trust lets you sign what you send, so the people you serve can tell the difference — and lets you see impersonation as it happens.
The portal demo uses two fictional organisations with published access codes. No real bank or government entity uses Tumaini, and no partnership exists.
Built for organisations at risk of impersonation
- Banks
- Government agencies
- Payment providers
- Businesses
- Educational institutions
- Telecoms
01
Prove
Issue verifiable communications and manage your institutional identity.
- Working in the prototype
Signed communications
Notices and payment requests signed with your registered Ed25519 key. Any recipient can verify them.
Try it - Working in the prototype
Signing identities
Generate, rotate and revoke keys. Private keys are encrypted at rest and destroyed on revocation.
Try it - Working in the prototype
Revocation
Withdraw a communication so it stops verifying everywhere, immediately.
Try it - Working in the prototype
Content Credentials for media
Sign images with C2PA so edits after publication are detectable.
02
Protect
Integrate verification into the workflows criminals target.
- Working in the prototype
Exact-scope authorisations
A signed request authorises one amount, one account, one time. Change a digit and it fails.
- Working in the prototype
Verification API
Check a message at the moment of payment with one public call.
Try it - Working in the prototype
Hold and verify
Risky transfers wait for independent confirmation, enforced by the server and the database.
- Planned
Webhooks into your systems
Push verification outcomes to your fraud tooling.
03
Respond
Review incidents, impersonation reports and verification evidence.
- Working in the prototype
Impersonation reports
Reports from the public that name you arrive in your incident queue at once.
Try it - Working in the prototype
Verification activity
See every check of your communications — and every failed one, a sign of fakes circulating.
Try it - Working in the prototype
Tamper-evident audit log
Every issue, revocation and key event in a hash-chained log.
Try it - Planned
Incident alerts
Email or webhook notification when reports spike.
What the people you serve see
A clear yes — for exactly what you sent.
When a customer checks your signed payment request, Tumaini confirms it came from you, that nothing changed, and exactly what it allows. A copy with a different amount or account fails.
- 1You sign a request in your systems or the portal.
- 2The customer receives it as usual.
- 3Tumaini verifies it — or warns them.
Getting started
From demo to pilot.
A proposed path. No pilot partnership exists yet.
Weeks 1–3
Approvals
Security and privacy review, data-protection impact assessment, integration design.
Weeks 4–6
Shadow mode
One high-risk flow. Tumaini observes; nothing is blocked.
Weeks 7–11
Opt-in live
Signed messages and hold-and-verify for opted-in customers.
Weeks 12–13
Decide
Independent evaluation against agreed targets: go, extend or stop.
Your engineers start with Tumaini Core.
API reference, a sandbox and a working integration with a fictional bank.