Security

Built to keep your money where it belongs

A payment gateway holds other people's money, so we treat every layer the way an exchange would. Here's exactly how.

Your account

Two-factor authentication
Authenticator-app codes to sign in, to reveal API keys and to send every withdrawal or payout.
Trusted IP addresses
Restrict your account to the networks you work from; sign-ins from anywhere else are refused.
Secret keys kept secret
Store keys are stored encrypted and only shown after a fresh 2FA check.
Signed callbacks
Every status notice to your server carries a hash made with your key, so fakes are easy to spot.

Mostly offline
Only the amount needed for day-to-day payouts sits in online wallets; the rest is moved to offline cold storage automatically.
Isolated signer
Private keys live on a separate machine with no inbound connections. The web servers can ask it to sign, never read the keys.
Two-person approval
Moving money out of cold storage needs one admin to request it and a different admin to approve it.
Hard limits
The signer refuses anything above its daily limits, and moves funds to cold storage only at addresses it already knows.

Ledger checked against the chain
Every wallet's balance on the blockchain is compared with our books, and any difference raises an alert.
Manual review for large payouts
Unusually large withdrawals wait for a person to check them before they're signed.
Audit trail
Every admin action is logged with who did it, from where and when.
Encrypted everywhere
HTTPS on every page and API call, and the admin panel is reachable only from approved networks.

Please tell us privately before sharing it anywhere else. Write to support@aywapay.com with the steps to reproduce it.