Signing in
Who you are and how long that session lasts.
Security you can check, not just believe.
Funds are split between an operational wallet and offline storage. Every deal gets its own single-use on-chain address. Large withdrawals need two people to approve them. Your recovery codes are stored hashed, so nobody here can read them.
Split hot and cold storageSingle-use deal addresses2FARecovery codes only you holdEncrypted at restFull audit trail
Getting in isn't the same as getting money out
Most platforms treat a successful login as permission to do anything. We don't. Three separate contours, three separate risk models, and clearing one doesn't clear the next.
Moving your money
What you're sending, where to, how much, how often, and from which device.
- No user access
- Split keys
- Regular audits
- Separate accounts
Platform funds
Key handling and treasury. Nothing in a user session reaches this layer, ever.
Split storage, single-use addresses
- 01
Split storage. An operational wallet covers day-to-day payouts. The bulk of funds sits offline, disconnected from the platform. When the operational wallet gets too full, the excess moves out automatically. There's a separate pair for every network we support.
- 02
Single-use addresses. Every deposit gets a fresh address. It's used once and never reused.
- 03
Encrypted at rest. Stored data is encrypted. Sensitive actions need 2FA on top.
- 04
Three figures, never one. Your balance always shows as available, in escrow and pending withdrawal — separately. Nothing is hidden inside a single number.
Your account, and everything that can weaken it
Sessions
Sessions are short-lived and rotate. Change your password or PIN, reset 2FA, go through recovery or relink Telegram, and every active session everywhere is killed instantly — not just the one you're on.
Two-person approval
Large withdrawals need two independent internal approvals before they're broadcast. One person on our side can't move your money.
Withdrawal checks
Daily cap. Velocity checks. A cooldown when money goes to an address you've never used before. Device and IP anomaly checks. Geo-checks.
Devices
Trusted devices are tracked. You can revoke any single device without touching the rest.
Ten codes. We can't read them, and neither can support.
Offline
When you set up your account you get ten one-time recovery codes. Keep them offline. They're stored hashed, which means support can't see them, admins can't see them and nobody here can reset your 2FA on your behalf. If someone calls claiming they can, it isn't us.
Single-use
Each code works once. Generate a new set and the old ten die instantly, and that regeneration goes into the audit log.
Limited
Email and phone codes sit at a lower trust level on purpose — they travel the same channels as your 2FA, so compromising one compromises both. They can reset a PIN or relink Telegram. They cannot wipe your 2FA. Only your recovery codes can do that.
Neither side can pull a runner
Funds in a deal sit at a single-use on-chain address created for that deal alone. Neither party can take them out unilaterally. On your balance they show as in escrow — visible, not spendable.
When the deal closes, funds settle back to the wallet the deal was created from. If someone opens a dispute, release pauses and nothing moves until both sides have been reviewed.
Nobody reads your deal chat unless a dispute is opened. No dispute, no access.
We don't collect what we don't need
The safest data is data that was never collected. You don't hand over documents to use the wallet, run a deal, swap or get a card, so there's no document pile there to leak. Banking is separate: an account in your own name needs a one-time verification.
The money landing next to yours
Every incoming deposit is screened before it reaches your balance. Anything that comes back flagged is held rather than credited, and accounts flagged against sanctions lists don't get deposit addresses at all.
This isn't surveillance of you. It's about what's sitting in the same pool as your money. A platform that lets dirty deposits in is a platform that eventually can't pay anyone out.
One honest side effect: screening takes a moment, so a deposit can confirm on-chain slightly before it appears in your balance. That gap is the check running.
Every claim, and the thing that backs it
Things we don't say
- 01
We don't say your funds are insured. They aren't.
- 02
We don't say our audit logs are tamper-proof. They're complete. Making them immutable is on the build list, not shipped.
- 03
We don't say you can't be phished. If someone gets your recovery codes, they get your account. Keep them offline and never type them into anything that isn't Fundscrow.
- 04
We don't say custody is risk-free. It isn't, anywhere. It's a trade: you don't manage keys, we do, and we tell you exactly how.
FAQ
Now you know how it's held.
Create an account, run a deal, move your money. The mechanisms above are already running.
