NordBalticum asks separate questions: is this a valid account session, is it running on the expected installation, and is this installation approved for the wallet? Passing one check does not silently satisfy the others.
Session binding
Wallet binding
MFA remains independent
01
Session-device trust
The session proves its relationship to the installation instead of relying on a bearer token alone.
02
Wallet-device authorization
The wallet maintains its own account-specific list of approved access environments.
03
Additional factor
If MFA is enabled, trusted-device possession does not bypass the factor for protected access.
Three boundaries, three jobs
Account authentication identifies the user. Session-device trust makes replay of sign-in material less useful outside the expected installation. Wallet-device authorization determines whether that installation may access the self-custody wallet.
Keeping these jobs separate prevents a convenient login mechanism from becoming the only defense around transaction authority.
What happens on a new device
A new device does not inherit wallet access because the same account signed in. It follows an explicit approval or recovery path, with fresh wallet confirmation where required.
On native platforms, device integrity evidence can strengthen installation trust, but it does not replace the wallet key, wallet PIN, MFA or recovery controls.
NordBalticum product view
A layered answer to a simple question: may this device act?
The system evaluates the account session, installation and wallet authorization without merging them into one all-powerful login state.
Practical flow
What to do next
1
Authenticate
Establish a legitimate NordBalticum account session.
2
Prove the installation
Complete the device trust flow appropriate to web or native app.
3
Authorize the wallet
Use an approved wallet device, pairing flow or recovery process before wallet access is granted.
Security, in plain English
Controls with defined responsibilities
Cryptographic possession
Device trust is based on installation-held cryptographic material rather than IP address alone.
No universal device shortcut
One account's approval does not automatically approve another account's wallet.
Revocable access
Recognized wallet devices can be reviewed and access can be removed.
Clear answers
Frequently asked
Is device binding based only on IP address?
No. IP and browser details are not treated as the sole authority for device trust.
Does native attestation hold my wallet key?
No. Native integrity evidence and wallet key protection remain separate concerns.
Can a trusted device bypass MFA?
No. If a verified MFA factor is enabled, trusted-device possession does not replace it.
