Your keys. Your funds. Always.

The security model

• We are non-custodial. Funds never sit with us.
• You hold the wallets and private keys at all times.
• We track payments on-chain and update invoice and order status.
• API tokens and auth data are stored encrypted, with access controls.

How funds move

Every payment starts and ends at your wallet. CPTPayment sits in the middle as an observer, not a custodian.

• You add payout wallets and give us public addresses. The private keys stay with you.
• We create invoices, each tied to one address and amount for tracking.
• Customers send crypto straight to your address. Their wallet broadcasts the transaction.
• We watch the chain and update the status (Paid, Underpaid, Expired) as matching transactions show up.
• Funds never pass through us. We do not hold the keys needed to move them.

What we store, and what we don't

• Private keys and seed phrases: never stored.
• Public wallet data: stored when it is needed for tracking.
• Payment and invoice data: stored.
• Auth secrets: stored encrypted.
• Card details (PAN, CVV): never processed.

Secure your own setup

Because funds never sit with us, your wallet and infrastructure are the real perimeter. Use this as a baseline.

• Use a hardware wallet and keep seed phrases offline. Never put them in screenshots or cloud notes.
• Keep treasury wallets separate from operational wallets at higher volume.
• Turn on MFA, rotate API tokens, and revoke ones you no longer use.
• Limit dashboard access to trusted staff and log access to your webhook handlers.
• Use different wallets for testing and production, and keep a small canary wallet to catch unexpected transfers.

Do you ever control or move my funds?

No. The model is non-custodial. We do not have the private keys that control your wallets, and we cannot move funds for you. Customers pay straight to addresses you set.

Do I need to share my private key or seed?

Never. We will never ask for your private key, seed phrase, or xprv. If anyone claiming to be from CPTPayment asks for them, treat it as a phishing attempt.

What if my account is compromised?

An attacker could view or change payout addresses, API tokens, or settings, but they still cannot touch funds already in your wallets. If it happens, rotate your API tokens, review payout addresses, revoke suspicious sessions, and check your store settings.