V-Key is a software security company that protects digital identities and mobile apps for banks, fintechs, governments, telcos and healthcare providers, mainly in Asia-Pacific. Its products replace SMS one-time passwords, passwords and hardware tokens with a secure digital identity held on the user’s phone, and harden the mobile apps that carry that identity against tampering and abuse.
Everything V-Key sells is built on V-OS, a virtual secure element that gives an app the kind of key protection normally provided by dedicated security hardware, entirely in software.
At A Glance
| Vendor | V-Key |
|---|---|
| Category | Digital identity, mobile authentication and mobile app protection |
| Identities covered | Human users, mobile apps and devices, AI agents tied to the human who deployed them |
| Deployment | SDKs, APIs, no-code app wrapper and white-label options |
| Agentic AI | Agentic Identity with CloudsineAI, AI chatbot in the V-Key Dashboard, PANDA malware detection |
| Certifications | FIPS 140-2, Common Criteria EAL3+, SOC 2 |
| Customers | Tonik Bank, DBS digibank, UOB |
| Ownership | Majority investor Tower Capital Asia |
What V-Key Does
Mobile banking and government apps face two kinds of attack. Some target the login: SIM swaps intercept SMS codes, phishing steals passwords and hardware tokens are costly to issue and easy to lose. Others target the app itself, through reverse engineering, repackaged copies, hooking and malware running on the same phone. V-Key addresses both with two product suites, V-Key Identity for the login and V-Key Shield for the app, that share the same foundation. Both suites keep their keys and biometric templates inside V-OS, so they do not depend on a phone’s trusted execution environment, secure element or any special hardware.
Products
V-OS Virtual Secure Element
V-OS is the technology under every other product. It runs a patented virtual machine inside the app that isolates keys, logic and data from tampering and extraction, giving app makers secure element level protection on any phone. Keys are never exposed outside the virtual machine, and the environment resists debugging, hooking and code injection.
V-Key ID
V-Key ID is for organisations that want to drop SMS codes and passwords in favour of “one secure, portable digital identity”. A user verifies once and can then sign in across devices and platforms without registering again, and the same verification speeds up sign-up for other apps. Biometric data is protected with privacy-preserving encryption backed by V-OS, meeting ISO/IEC 30136 without storing facial images. Because the identity lives in a protected environment on the phone, it blocks SIM swap and phishing attacks. Integration into existing enterprise systems takes a single API call.
V-OS Smart Token
V-OS Smart Token replaces SMS one-time passwords and physical hardware tokens with a certified soft token on the user’s phone. It handles OTP and PKI-based authentication and works without an internet connection.
V-Key Smart Authenticator
The Smart Authenticator turns a phone into a multi-factor authenticator for workforce or customer logins. Users approve sign-ins by push notification, QR code, one-time password or biometrics, and can back up and restore the authenticator when they move to a new phone.
V-OS Biometric Identities
Biometric Identities handles remote onboarding, where a bank or agency needs to confirm that a new customer is a real, present person. It checks liveness, matches a face in under 500 milliseconds and stores face templates encrypted. The product complies with ISO/IEC and ICAO standards.
V-OS Mobile App Protection
Mobile App Protection watches a running app for threats such as malware, debugging or tampering and stops them in real time. App owners can define their own responses to each threat.
V-OS App Shield
App Shield is a no-code wrapper for teams that need protection without changing their source code. It applies anti-reverse engineering and obfuscation to the app package and protects it from tampering, repackaging and runtime abuse.
V-OS App Identity
App Identity establishes trust between an app and its back end. It signs and encrypts every API call and verifies the app’s integrity in real time.
How It Works
V-Key’s security functions run inside the customer’s own mobile app, anchored by V-OS, with protection delivered across all major mobile platforms from one foundation.
| Component | What it does |
|---|---|
| SDKs and APIs | Identity and protection features are added through modular SDKs, APIs and white-label options. The company reports that secure authentication can be set up within weeks. |
| No-code wrapper | App Shield can be applied to an existing app package instead of integrating an SDK. |
| Dashboard | The V-Key Dashboard gives security teams live threat intelligence from protected apps. |
Identities And Systems Covered
| Human users | Customers and employees who authenticate with V-Key ID, Smart Token and Smart Authenticator, and who are enrolled through biometric onboarding. |
|---|---|
| Mobile apps | Apps protected at runtime and through wrapping, each carrying its own app identity for API calls. |
| Keys and credentials | Cryptographic keys, OTP seeds, PKI credentials and encrypted face templates held in V-OS. |
| AI agents | Agents given a verifiable identity linked to the person who deployed them. |
| Enterprise systems | Back-end systems connected through SDKs and the V-Key ID API. |
Agentic AI Capabilities
Agentic Identity
Agentic Identity, demonstrated with CloudsineAI, “gives every AI agent a verifiable identity, tied to the human who deployed it.” V-Key ID authenticates the person behind each agent and signs off on what the agent is allowed to do. Authorisation scales with risk: in the demonstration, agents made low-value payments on their own, while a higher-value payment sent a push request through V-Key ID so that a person had to approve before any money moved. The model has two stages, a verified identity before an agent acts and continuous monitoring after it does. CloudsineAI handles the second stage, watching agent behaviour, flagging rogue instructions and scope drift, and keeping an auditable trail.
AI In The Product
| PANDA | AI malware detection for app protection. |
|---|---|
| AI chatbot | An assistant in the V-Key Dashboard built on large language models that run within V-OS cloud infrastructure. |
Company Background
| Founded | 2011, when work on V-OS began. |
|---|---|
| Partners | Technology partnerships with Innovatrics, Crunchfish and Regula for identity verification. |
| Headquarters | Singapore. |
| Leadership | Joseph Gan (co-founder and CEO), Chiangkai Er (CTO) and Raymond Lee (COO). |
| Ownership | Tower Capital Asia became the majority investor in February 2026, for an undisclosed amount. |
| Acquisitions | A strategic majority investment in CloudsineAI, a Singapore-based AI cybersecurity and web integrity company, announced in October 2026. |
| Scale | V-OS runs on a reported 500 million mobile devices worldwide. |
| Regulatory alignment | Meets the information security standards of the Australian Prudential Regulation Authority (APRA) and aligns with Bank Negara Malaysia’s mobile banking security framework. |
| Recognition | Red Herring 100 Global and Asia, and the Asian Banker Technology Innovation Award. |
Note: This overview is compiled from V-Key’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.