Security
Practices we use to protect merchant accounts, keys, and funds movement.
Custody model
Deposit addresses are HD-derived from a platform seed. Private keys are not stored in the application database. On-chain monitoring and balance credits are driven by confirmed transactions and an append-only ledger.
Account security
- Passwords hashed with scrypt
- Account recovery key / phrase: plaintext is never stored — only a SHA-256 hash; shown once at signup or after a reset
- Stateless HMAC-signed session cookies
- Optional TOTP 2FA with backup codes
- Withdraw IP allowlists (requires 2FA)
- API keys: full
swp_live_…secret is never stored — only a SHA-256 hash and short prefix; shown once at creation. Optional IP allowlists per key
Webhooks
Event payloads are signed with HMAC-SHA256. Verify X-Swp-Signature using your merchant webhook secret before trusting status changes. Details: Webhooks.
Report a vulnerability
Email [email protected] with a clear description and reproduction steps. Please give us a reasonable window before public disclosure.