How your account is protected.

Your connected wallet stays yours

Wallet sign-in uses a signed, one-time message to verify ownership. Each request is bound to this website and your browser, expires after ten minutes, and can only be used once. Signing in does not authorize a transfer or token approval. Tezopay never asks for your connected wallet’s private key or recovery phrase.

A separate wallet for funding

Tezopay creates and manages a dedicated deposit wallet for your account. Its private key is encrypted before it is stored, and key access is restricted to the backend service. The deposit wallet is custodial; it is separate from the wallet you connect for sign-in.

Your payment balance, funds held for requests, and card balances are tracked separately. A deposit is credited once after its transfer is verified. A card top-up becomes spendable after confirmation.

Card details stay protected

Card details supplied for your order are encrypted before storage and masked by default. Only the cardholder can reveal them after a recent sign-in. Details hide after 20 seconds and clear when you leave this tab or close the view. Some card programs use a secure provider page for this step.

Account access and sessions

Email sign-in uses a password stored as a salted hash. Sessions use secure, HttpOnly cookies. You can review and end your sessions in account settings. Administrator access uses a separate login and session, with recent verification required for sensitive changes.

Stay in control

Review wallet requests before signing, check the network and deposit address, and keep your wallet recovery information private. If a payment is pending, check its status before sending again. Contact support from your account when you need help.