When your customers hold a balance with you, they are trusting you with money rather than with data alone. This page says what we do about that, what we deliberately do not do and what we are still working through.
Each control below is one we can show you in the product.
Six controls sit between a person and the money they hold. They are described here in the same words we would use in a review.
When a card is used to load money, the number is entered on the payment provider's own secure page. It does not pass through our system and we do not hold it.
What this means for you. A card number cannot be taken from us, because we never had it.
Each movement is written on both sides and checked against itself. If the two sides disagree, the difference is raised rather than absorbed.
What this means for you. A balance you are shown can be traced back to the movements that made it.
Money does not leave automatically. A withdrawal is reviewed and evidenced by a named person before it is released. Withdrawals are manually reviewed and typically processed within 1 to 3 business days.
What this means for you. Money cannot be drained out of a wallet at machine speed.
On signing in, and again before a transfer. A one-time code is required before a transfer is executed, and the request is rate-limited.
What this means for you. A stolen password on its own is not enough to move money.
Tokens and sensitive data are encrypted with AES-256-GCM. That covers the values a system passes between its parts as well as the ones it stores.
What this means for you. A value read out of storage or off the wire is not usable on its own.
Access is granted by role rather than by person. Someone who reviews withdrawals is not the same person who can change what a wallet is allowed to do.
What this means for you. The list of who can do what is short enough to read and review.
The absences matter as much as the controls, so they are written down here rather than left to be assumed.
Personal information is handled under our Privacy Policy. Our legal and security team can take you through our controls in detail.
No. A wallet is not a bank account and it is not a card gateway. It is the layer that holds and moves money between the people in your product.
They are entered on the payment provider's own secure page. They do not pass through our system and we do not hold them.
Not on this site. What is on this page is the mechanism: how money is recorded, who reviews it leaving, and what a wallet holder has to do to move it. Ask us and we will tell you what else exists today.
No. Transfers are instant, and they cannot be reversed. That is why the wallet says so before anyone confirms one, and asks for a one-time code first.
Access is role-based, so a person sees the wallets their role covers and nothing else. Every wallet holder has two-factor authentication on login and before a transfer.
We would rather show you a control in the product than describe one on a page.
