Security
What stands between your balance and everyone else.
We assume things will go wrong and design for the morning after. Here is how balances are held, how your account is protected, and what we publish when something breaks.
Custody
Customer assets are held separately from company funds, in wallets used for nothing else. The cold store is a multi-party computation setup: five key shares in four cities, any three of which are needed to sign. The remaining 8% sits in hot wallets sized to cover roughly two days of card spending and withdrawals.
An independent accounting firm checks that customer balances are fully backed and publishes an attestation on the 15th of each month, covering the last day of the previous month.
Your account
- 2.1
Passkeys
Sign in with a passkey on your phone. Passwords are optional and, if set, require a second factor.
- 2.2
Online payment approval
When a shop asks for extra verification, you approve the payment in the app within five minutes.
- 2.3
24-hour address lock
A newly added withdrawal address can receive funds only after 24 hours. You get an email and a push notification when one is added.
- 2.4
Device binding
The app works on one phone at a time. Moving to a new phone requires a video selfie check.
- 2.5
Location matching
Optionally decline in-person payments when your phone is in a different country from the terminal.
Fraud and disputes
If a payment you did not make appears in your account, freeze the card and report it in the app. For payments we confirm as unauthorised, we return the amount within 10 business days, in the asset that was spent. Reports can be made up to 13 months after the payment date.
We will never ask for your passkey, a one-time code, or to move funds to a “safe account”. Anyone who does is not us.
Reporting a vulnerability
We run a bug bounty for our app, website and APIs. Rewards range from $250 to $40,000 depending on severity. Write to security@velorinpay.com; we acknowledge reports within two business days. Please do not test against other customers’ accounts or degrade the service.