Account trust & security

Protect your Project Genesis account

Use this page to identify official Project Genesis account links, understand one-time security credentials, and know what to do when a message or sign-in request looks suspicious.

Recognize official account links

Project Genesis account actions delivered by email should open on the official website host shown above. Localized paths may appear before /auth/.

Check that the browser host is exactly projectgenesis.velunthic.com before continuing.
Official account-action links use HTTPS.
A one-time credential may appear only after # in the URL, for example #token=… or #code=….
Do not continue if the host is misspelled, uses an unexpected domain, or the browser reports a certificate problem.

One-time security links

Email verification, password reset, email change, and authentication completion can use credentials designed for a single security operation. The web application reads the credential from the URL fragment and removes the fragment from the address bar after reading it.

Never send a token, code, or complete one-time link to support or another person. If a link was already used or has expired, request a new one through Project Genesis.

Google, Microsoft, Facebook and Apple

Project Genesis may use external identity providers for sign-in. Their credentials belong to those providers and must only be entered on the provider’s own official sign-in experience.

Project Genesis will never ask you to type your Google, Microsoft, Facebook or Apple password into a Project Genesis form.

Project Genesis will never ask you to

Send us your password, verification token, password-reset token, authentication code, or complete one-time link.
Disable browser security warnings or install unknown software to access your account.
Provide an external identity-provider password directly to Project Genesis.
Pay someone to verify, unlock, or recover your account through an unofficial channel.

Security capabilities

Account protection built into Project Genesis

Project Genesis includes multiple layers of account protection for authentication, recovery and session control.

Account security settings and account-management actions are initiated and managed from the Project Genesis mobile app. This website is informational and is used only for specific secure browser confirmations when a flow requires them.

Passkeys

Project Genesis supports passwordless authentication with passkeys, using the security capabilities of your device instead of a reusable password.

Multi-factor authentication

TOTP-based multi-factor authentication adds a second factor to supported sign-ins, with one-time recovery codes available for account recovery.

Session control

Active account sessions can be reviewed and revoked individually, or other sessions can be closed while keeping the current session active.

Multiple sign-in methods

An account can use a local password and supported external identity providers. Linked methods can be managed while preserving at least one valid way to access the account.

Verified Android app association

On supported Android environments, Project Genesis uses Digital Asset Links to verify the relationship between the configured Velunthic domain and the signed mobile app. This helps prevent passkey operations from being accepted for an unassociated app or domain.

Protected recovery flows

Email verification, password reset, email change and last-resort MFA recovery use dedicated security flows designed to limit credential exposure and unauthorized account changes.

Recommended authenticator

Set up MFA by scanning one QR code

When you enable MFA in the Project Genesis mobile app, Project Genesis will show a QR code containing the TOTP configuration your authenticator needs.

Recommended app2FAS Auth

We recommend 2FAS Auth: a free, open-source authenticator that works offline and does not require a 2FAS account.

View 2FAS Auth on the App Store Get 2FAS Auth on Google Play

What you need to do

Install 2FAS Auth from its official App Store or Google Play listing.
When Project Genesis shows the MFA QR code in the mobile app, open 2FAS Auth and scan that QR code.
2FAS Auth will add Project Genesis and show a six-digit code. Enter that code in Project Genesis to confirm MFA activation.
After activation, save the Project Genesis recovery codes in a secure place separate from the authenticator device.

No manual TOTP configuration is required. The Project Genesis QR code already contains the required settings, so do not change advanced token parameters after scanning it.

Treat the QR code as a secret: anyone who captures it may be able to generate your MFA codes. Do not share it or keep unnecessary copies.

2FAS Auth is the recommended authenticator. Another authenticator may be compatible only if it correctly honors the TOTP settings encoded in the Project Genesis QR code.

If a link or message looks suspicious

Do not use the link until you have verified it. A security message that creates urgency is not a reason to bypass browser warnings or disclose credentials.

Close the page without entering account information.
Open projectgenesis.velunthic.com yourself instead of following the suspicious link.
Do not forward the active one-time credential. If you need help, describe the issue without including the token or code.
Contact Project Genesis support and request a fresh security action if the original link may have been exposed.

PROJECT GENESIS · VELUNTHIC

Need account-security help?

Contact the official Project Genesis support address. Include what happened and any non-sensitive error reference shown by the site, but never include passwords, tokens or authentication codes.

Contact account support