Get started

Security · Company

Security starts with what we never hold.

ChainPal never holds your money or the keys to your treasury. Payments land on addresses made for them and move straight on to destinations you own, and your team, not ChainPal, decides who can move funds and where they go.

Get started Report an issue

No pooled balancesTreasuries owned by your passkeysVerified businesses only

Your business

Verified before it takes a payment

  • Business verification (KYB)
  • Two-factor sign-in for your team

Single-use address

0x7f3a…c21e

  • Made for one payment, nothing pools
  • Every payment traces to one record

Your destination

Bank, treasury or your own wallet

  • Reviewed by ChainPal before first use
  • Bank account name checked against yours
  • Wallets prove control with a signature
Held by ChainPal Nothing

Illustrative. The address shown is a sample.

Non-custodial architecture

Eight controls. Not one requires holding your money.

None of them depend on trusting ChainPal with your money, because ChainPal never has it. They decide where money is allowed to go, and who on your team can send it.

  1. 01

    Single-use addresses

    Each checkout, invoice and payment link payment arrives on an address of its own, so funds never pool and every payment matches one record.

  2. 02

    Destinations reviewed

    Every bank account, treasury and wallet is reviewed by ChainPal before any money can reach it.

  3. 03

    Bank names checked

    A bank account’s name is checked against your business before it can receive payouts.

  4. 04

    Wallet proof of control

    An external wallet needs a signed proof that your business controls it.

  5. 05

    Treasury passkeys

    Your treasury is a Safe owned by your business’s passkeys. There is no seed phrase, and ChainPal never holds a key.

  6. 06

    Team approvals

    A withdrawal is approved by a colleague before a passkey signs it. The person who asked can never approve it.

  7. 07

    Cooldowns

    A business with a single controller waits 24 hours before a new destination can be used.

  8. 08

    Verified businesses

    Every business completes verification (KYB) before it can take payments on ChainPal.

Treasury

Your keys, your colleagues, your call.

Your treasury is a Safe owned by your business’s passkeys. Moving money out takes three steps: someone asks, a colleague approves, and a passkey signs. ChainPal’s relayer then submits the transaction and pays the gas, which is not the same as holding the funds.

  • No seed phrase. Nothing to write down, lose or leak.
  • No key held by ChainPal. We cannot sign for you.
  • Extra passkeys are for recovery, in case a device is lost. One passkey signs.
How Treasury works

Illustrative. A sample withdrawal for Harbourview Markets Ltd.

Test and live

Rehearsals never touch real money.

Test mode has its own keys, its own webhook address and its own networks. A request is test or live because of the key it carries, so there is no switch to forget to flip, and test payments can only settle to wallets.

The developer overview

Keys and transport

Locked down at the edges too.

The API, the webhooks and your team’s sign-in each have their own protection, on top of the architecture above.

Keys shown once, stored hashed

Four keys per business: test and live, publishable and secret. Each is shown once when it is made, and only a hash is kept.

cp_pk_live_ · cp_sk_live_

An IP allowlist for secret keys

Name up to three server addresses, and a secret key used from anywhere else is refused.

203.0.113.10 · 203.0.113.11

Signed webhooks

Every webhook is signed with HMAC-SHA256 over its timestamp and raw body, so your server can prove it came from ChainPal.

X-ChainPal-Signature: v1=…

HTTPS-only webhooks

Webhook addresses must use https, with separate addresses for test and live.

https://…/hooks/chainpal

Rate limits

30 requests a minute on a publishable key and 100 on a secret key.

30 / min · 100 / min

Two-factor sign-in

Protect every login to your dashboard with an authenticator app.

Authenticator app

Illustrative. Sample key prefixes and documentation-range addresses.

People and powers

The right people, with only the powers they need.

Give each teammate a role, withhold any single power from anyone, and decide which decisions need a second person. Switching a control on takes one click; switching it off takes a colleague.

Controls for finance teams
  • Six rolesOwner, Admin, Treasurer, Operator, Analyst and Auditor.
  • Powers withheld per personTake one power away from one member without changing their role.
  • Approval policiesRequire a colleague for treasuries, withdrawals and team changes.
  • Auditor access that endsAn auditor’s access stops on the date you set.

Responsible disclosure

Found a vulnerability? Tell us first.

If you believe you have found a security issue in ChainPal, email help@chainpal.org with “Security report” in the subject. A person on the team will read it and reply.

Email a security report

What helps us most

  • The steps to reproduce it
  • The page, endpoint or request involved
  • What you could see or do that you should not have

What we ask of you

  • Test with your own account, in test mode where you can
  • Do not access, change or keep data that is not yours
  • Give us a fair chance to fix it before you tell anyone else
From the blog

Why ChainPal is never a custodian

The first decision we made, what it rules out, and why a treasury team should care that it was made before anything else.

Read the post

Open for business

Build on rails you control.

Open an account, choose where each product settles and take your first payment in digital dollars. No setup fee, and no balance held on your behalf.

Get started Talk to our team