Security

What non-custodial actually guarantees, what we do to protect your account, and the four things we need you to do.

The custody guarantee

Payaider never holds your funds, not even in transit. There are no Payaider-controlled keys, no sweep wallets, and no mechanism by which we could redirect a payment that is already on its way. Our fees are invoiced separately and are never skimmed from the on-chain flow.

Payaider can	Payaider cannot
Observe transfers to your addresses.	Move, freeze or reverse your funds.
Refuse to create new payments for your account.	Touch a payment already in flight.
Show you every payment and every event.	Sign anything with a key of yours.

The corollary is the part people underestimate: an on-chain payment to a wrong address is unrecoverable by anyone, including us. That is why wallet verification is strict and why route changes are gated.

Your four jobs

Verify every webhook signature, against the raw body, in constant time. A forged payment.confirmed is the single highest-value attack against you.
Keep secret keys server-side and in a secret manager. Publishable keys are the only credential that belongs in a browser.
Turn on MFA for everyone with dashboard access. Route changes are how an account takeover monetizes itself.
Fulfil on payment.confirmed only — not on detected, not on a redirect.

High-risk actions

These re-prompt for MFA, write an audit event and email you, every time: adding or verifying a wallet, changing a route, creating or revealing an API key, changing a webhook endpoint, inviting a teammate, changing fee configuration.

Route changes additionally sit in a cool-down before the new route receives quotes, so a redirect-everything attack gives you a window rather than a surprise.

Platform controls

Argon2id password hashing, TOTP MFA, session and device management.
API keys stored hashed; secrets held in a KMS; webhook secrets and TOTP seeds encrypted at rest.
Strict request validation, per-key and per-IP rate limits, and a size cap on every body.
SSRF-safe webhook egress: DNS re-resolved per attempt, private ranges blocked, no redirects followed, 10-second timeout.
Append-only payment_events, fee_ledger and audit_logs tables, enforced by database grants rather than by convention.
Nightly reconciliation that re-derives balances from chain data and alarms on any drift.

Sanctions and geography

Checkout, payment links and invoice pages are IP-geoblocked for prohibited jurisdictions, and payer wallet addresses are screened in real time before any payment reaches confirmed. A high-risk address puts the payment on a compliance hold rather than confirming it.

Screening fails closed: if the provider does not answer, the payment waits. Sanctions liability is strict, and a processor that screened its merchants but not its merchants’ customers has already been fined for exactly that gap.

Reporting a vulnerability

Email security@payaider.com. We acknowledge within one business day, and we do not pursue researchers who act in good faith and give us time to fix things.