Security
What is protected, and by what
No compliance badges and no promises of military grade encryption. Below are the concrete decisions and their limits.
Money
The server physically cannot spend funds
This is not an access policy that can be bypassed, it is a property of the key scheme in use.
- Where the seed lives
- The wallet seed is created on the owner's machine and never leaves it. It is not in the server environment and never has been.
- What the server holds
- Extended public keys only. Receiving addresses derive from them. A transfer cannot be signed with such keys.
- Sweeping funds
- A separate offline script, run by hand. It asks the owner for the seed, signs the transfers and saves nothing anywhere.
- The limit
- Compromising the server would allow the address shown on an invoice page to be swapped. That is why the page shows the full address and repeats it in the QR code: a mismatch is visible to the eye.
Accounts
Passwords and sessions
- Password storage
- Passwords are stored as a scrypt hash with a per account salt. The password itself is never stored and never logged.
- Sessions
- The cookie carries a random token; the database keeps only its SHA-256. A database leak does not let anyone sign in.
- Password guessing
- The sign in attempt limit is counted in the database rather than in process memory, so it survives a restart.
Data
What is stored and what is not
Stored
- Email address and password hash
- Your briefs and the packs generated from them
- The credit ledger, debits and credits
- Invoices and their state
Not stored
- Raw IP addresses: an irreversible hash is used for defence instead
- Card details: they never pass through our server at all
- Private keys and seed phrases
- Third party analytics and trackers on public pages
Abuse
How the public pages are protected from bots
Without a third party widget: a captcha that hands your visitors to another company is not needed here.
- Proof of work
- Before a form is submitted the browser solves a computation. A person does not notice it; a script pays processor time for every single request.
- Single use
- A solved puzzle buys exactly one request. Replaying the pair is rejected on a unique key in the database.
- Rate
- Window counters live in the database against a client hash rather than an address. The limits survive restarts and hold across replicas.
- The trap
- A hidden field a real form leaves empty. A filled one rejects the request without comment.
Found a problem
Tell us and we will answer
We run no bounty programme, but a report of a genuine vulnerability gets an answer the same day and a fix as the first priority.