Security

Keys and custody

• Private keys for wallets and the treasury are encrypted with AES-256-GCM before they are stored. The encryption key is kept outside the database.
• Keys are decrypted only to sign. No API returns them, including the admin API.
• Changing or draining a treasury wallet requires confirming an additional credential, which locks after five failed attempts. Every action is logged.

Payment integrity

• Every withdrawal is reserved under a unique identifier before it is signed, and the database rejects a second record with that identifier.
• If a send fails, the reservation is released only when we can prove it never reached the network. If there is doubt, it is held for manual review.
• A deposit is confirmed once it reaches the minimum confirmations set for its network.
• Each deposit settles through one route only: a custodial payout or a sweep to the merchant's wallet.

Sanctions

We check addresses in both directions against our blocklist, which includes the OFAC SDN list and our own entries:

• Outbound: before signing a treasury withdrawal or paying out to a merchant wallet. If the destination is on the list, nothing is sent.
• Inbound: before crediting a V2 API deposit. If the sender is on the list, the deposit is held without being notified or settled until it is reviewed.
• If the check fails, the payment waits for the next attempt.

Webhooks

• When a merchant sets a webhook_secret, every notification is signed with HMAC-SHA256 in the X-Signature-256 header.
• The destination URL is validated when it is saved and again before each delivery, so it cannot point at private or internal addresses.

Access and isolation

• Each merchant can reach only its own data, with an API key or from the dashboard.
• Dashboard sessions use signed, HttpOnly cookies that expire after 30 days.
• The API key can be rotated through the API at any time. Doing so invalidates every session opened with the old key.
• Failed login attempts are limited per IP address.
• Scheduled jobs and internal routes that move funds require their own secret, compared in constant time. If that secret is missing on the server, access is refused.
• The database does not allow anonymous access: the application connects with a service credential.

Transport

• The site and API are served over HTTPS, with HSTS enabled for the domain and its subdomains.
• The site cannot be embedded in third-party pages.

Minimal data

An account needs no email, phone number, or identity documents.

Read the Privacy Policy

Development

• Automated tests and static analysis run on every change.
• Some tests fail if an internal route loses its authentication or a known credential appears in the code.
• Dependencies are reviewed weekly, and every change goes through a security advisory audit.

Vendors

These are the vendors we use to operate the service: