Authy is a two-factor authentication app from Twilio. It generates one-time codes for accounts with other services, so that signing in with a password alone is not enough. The account is tied to a phone number, with an email address used for verification and recovery. The service is offered as a mobile app; the desktop versions were retired in 2024.
Authy is part of Twilio Inc., headquartered in San Francisco in the United States. According to Twilio's privacy notice, processing takes place primarily in the US; for transfers from the EEA Twilio relies on measures such as the EU-US Data Privacy Framework, binding corporate rules and standard contractual clauses, and European customers are served by an Irish entity, Twilio Ireland Limited. Twilio's data protection addendum explicitly covers the GDPR. As a US company, the service falls under US legislation such as the CLOUD Act, which a European organisation should weigh before storing tokens for business accounts in Authy.