Security and trust
No custody, no signing on your behalf, no promises to recover lost funds. Here is what we defend, how we prove it, and what we won't do.
What we don't do
No asset custody
We never hold, move or custody user assets. We don't offer custodial accounts, MPC/HSM signing or programmatic signing. Your own wallet always signs and broadcasts revocations and transactions.
No private keys, ever
Our APIs, pages, logs and support staff never ask for private keys or seed phrases. We only read public onchain data and cannot sign on your behalf.
No recovery guarantees
We do not promise to recover lost assets. At-risk amounts estimate exposure, not recoverable funds. This tool helps reduce future risk rather than reverse past losses.
How we protect your account and data
Only key hashes are stored
Plaintext keys are not stored, and upstream credentials are kept out of application data. Key disabling, limit changes and routing changes take effect globally within 30 seconds.
Least privilege and multifactor authentication
Console permissions are role-based. Administrators and owners must enable multifactor authentication; accounts without it are restricted to read-only roles.
Two-person review and auditing
Sensitive actions such as data deletion, emergency suspension and billing-period adjustments require confirmation from a second administrator. All permission and key changes are audited with the actor, time, source IP and before-and-after values.
Revocations require an onchain state check
A broadcast is not a revocation. We read state back by transaction hash and handle pending, replaced, and reorged transactions. A failed revocation is never shown as success.
Explainable risk assessments
Each risk includes a reason, evidence, source and update time. Commercial partnerships do not influence risk assessments.
Durable usage records
Every usage event is written before it hits the ledger, and duplicates are dropped automatically. Anomalies trigger alerts and caps; charges can be recomputed and reconciled.
12 attack surfaces and their controls
We suspend any feature with a critical issue: wrong signatures, wrong revocations, key exposure or commercial tampering with risk assessments. We don't ship first and fix later.
| ID | Attack surface | Required controls | Release evidence |
|---|---|---|---|
| S-01 | Wallet connections and domains | HTTPS, domain protection, network and chain identifiers, and clear notices before connecting | Domain and certificate inventory, and connection replay records |
| S-02 | Transaction previews and revocations | Independent decoding of calldata, onchain simulation, raw target and outcome shown before confirmation | Per-transaction comparison of simulated and onchain outcomes |
| S-03 | RPC and indexing services | Cross-checks across sources, displayed block heights, latency indicators and fallback on anomalies | Node failover and inconsistent-data drills |
| S-04 | Chain reorganizations and transaction replacements | Required confirmations, state checks, retries after reorganizations, and no false success reports | Testnet reorganization and replacement tests |
| S-05 | Contract and token metadata | Contract addresses take precedence, metadata sources are ranked, and proxy and upgrade status is shown | Malicious metadata sample tests |
| S-06 | Web application | Input and output encoding, session protection, permission checks, rate limits, dependency scans and security response headers | DAST, dependency inventory and authorization bypass tests |
| S-07 | Operations console | Multifactor authentication, least privilege, two-person review, release rollback and action auditing | Role matrix, audit logs and rollback drills |
| S-08 | Development and dependencies | No committed secrets or sensitive data, code review, pinned dependencies, SBOM and release approval | Review records, dependency scans and secret scans |
| S-09 | Browser extension | Least privilege, signed releases, version rollback, permission explanations and independent reviews | Store review records and permission tests |
| S-10 | Data and privacy | Data minimization, tiered access, redaction, retention periods, deletion and export | Data flow diagrams, access spot checks and deletion replay records |
| S-11 | Partnerships and monetization | Risk assessments isolated from commercial teams, promotion labels and partnership exclusion lists | Partnership approval and content review records |
| S-12 | Availability and incident response | Rate limits, caching, graceful degradation, emergency shutdown, notifications and disaster recovery | Load tests, failover drills and post-incident reviews |
Vulnerability incidents and risk-label changes
Each advisory includes its source, reviewer and update time.
Compliance and data processing
- Data minimization
- We collect only the data the service needs. Onchain data is already public, and we don't build profiles on top of it to sell.
- Tiered access
- Access is tiered by role, and sensitive fields are redacted. Every access lands in the audit log.
- Retention
- Usage details are kept for 90 days. Audit logs and bills stay for the legally required period, then are removed automatically.
- Deletion and export
- Export or delete your platform records in Account and Data. Public onchain data is unaffected.
- Data storage region
- Data is stored in the service's region by default. Enterprise customers can agree on a data residency region.
- Automatic revocation and notifications
- Automatic revocation, gas subsidies, address profiling, notifications, and data export each get their own permission and privacy notice. All are off by default.
- Payments and tax
- Refund rules are set out in the Terms of Service. Section 3 lists the operating entity, regions, payment channels, and tax treatment.
Vulnerability disclosure process
Do not send credentials that can control assets, even for reproduction. Use a test wallet address instead.
Security and responsibility
We can read public onchain balances, approvals and transactions, just like a block explorer. We cannot move your assets: every transfer requires your wallet's signature, and signing authority always stays with you.
Automatic revocation is off by default. We enable it only when the scope is provable and failures are recoverable. The wallet and chain must also pass security checks. Rules cover only the approval types you tick, within a budget and an expiry date. Any rule can be paused at any time.
We consider allowance size, the approved contract's reputation and history, prolonged inactivity and matches to published vulnerability incidents. Each assessment retains a reason, evidence, source and update time for individual verification.
No. Findings are produced independently of the commercial team. Partnerships and promotions are clearly labeled. An exclusion list keeps us from taking deals that would sway findings.
No, and we do not promise recovery. Onchain transactions are irreversible. We help identify and revoke remaining high-risk approvals and monitor new approval changes to reduce the risk of further loss.
Found a security issue?
Report it through our security channel with reproduction steps and impact. We acknowledge every report within 3 business days.