What stays on your phone and never leaves it
- Your recovery phrase and private keys are created on the device and stored encrypted in the system vault (Keychain on iPhone, Keystore on Android).
- To open the wallet and confirm transfers, the app asks for biometrics or a PIN.
- Transactions are signed on the device. Only the already-signed transaction goes to the network.
- Kripto Pay's servers never receive your keys or hold your balance. They're used for things like price quotes and notifications.
Open standards
The wallet follows the standards used by the main wallets on the market (BIP39 for the recovery phrase and BIP44 for accounts). That means you're not locked into Kripto Pay: with your recovery phrase, you can open the same wallet in another compatible app.
Before launch
- Wallet code open for anyone to review.
- Independent security audit, with the report published.
- Closed testing period (beta) with small amounts.
What we will never do
- Ask for your recovery phrase or private key, through any channel.
- Hold your balance or move your coins.
- Promise returns or recommend investments.
- Ask you to install another app or visit a website to “validate” your wallet.
Found a vulnerability?
If you find a vulnerability, let us know through the contact page, with the subject “Security”, before disclosing it. We'll reply and give credit to whoever reports it.