Security & Trust Center
What we do to protect your money and your data, in plain language. Where a certification or control is still on the roadmap, we label it as a target rather than claim it.
Encryption everywhere
Your data is encrypted in transit between your device and our servers, and at rest in our systems.
Multi-factor authentication
Signing in and authorizing transfers requires a second factor. Passkeys are available where your device supports them.
Device and session management
See every signed-in session and device, get notified about new ones, and sign them out remotely.
Transaction authentication
Moving money requires explicit authentication at the moment you approve — not just being signed in.
Strict internal access
Staff roles are narrowly scoped: support sees masked details, and no single staff member can move client funds alone — two distinct authorizers are required.
Complete audit trail
Every sensitive action, by clients and staff alike, is written to an append-only audit log that cannot be edited after the fact.
Tokenized card data
Raw card numbers and security codes never touch our servers; card data is held in tokenized form through the regulated issuer.
Independent testing
We commit to independent penetration testing at least annually and after major architecture changes, and to SOC 2 Type II and ISO 27001 as roadmap milestones — these are targets, not certifications we already claim.
If something looks wrong
Freeze a card instantly from the app, sign out sessions you don't recognize, and contact Technical Support through the secure channel on our Contact page. We will never ask for your password, full card security code, or authentication codes through chat or email.
Security researchers: a vulnerability-disclosure channel is listed on the Contact page under Technical Support.