Security
Built so you never have to trust us blindly
Handling other people's money means the security has to be real, not reassuring theatre. Here is exactly how ChainFlow protects your keys, your funds and your data — and where the honest boundaries are.
Controls
The safeguards, in plain terms
Signed webhooks
Every event is HMAC-SHA256 signed over <timestamp>.<body>. Verify it before you trust it — replayed or forged events won't match.
Spending PIN
A 4-digit PIN gates payments and transfers from a consumer wallet balance. Stored only as a salted hash, never in plain text.
Atomic balances
Balance changes are single atomic operations with an overdraft guard, so concurrent charges and withdrawals can never race into a negative balance.
Gas fronted safely
The platform funds the tiny gas needed to sweep deposits — your customers never need to hold BNB, and the gas wallet is monitored for low balance.
Confirmations before settle
Payments are only marked confirmed after the chain settles them. Only confirmed funds sweep, so a reorg can't hand you money that isn't there.
No blind fallbacks
In production the server refuses to run on anything but its real database — it fails loudly rather than silently serving empty or volatile data.
The honest boundary
What we hold, and what we don’t
Two different products, two different trust models — and we won’t blur them.
- Merchant payments are non-custodial. A customer pays, and the funds sweep to a wallet whose key you control. We never hold your revenue — you can export the key and walk away with it.
- The consumer wallet is custodial, by design. Instant, gasless payments and recurring billing only work because we hold a balance for the user — the same trade-off any exchange makes. We’re upfront that this part depends on trusting us, and we protect it with atomic accounting and a hot/gas float we monitor.
Found something?
Responsible disclosure is welcome. Email security@chainflow.dev and we’ll respond fast. Please give us a chance to fix it before going public.