Custody & security
Not “we would never”.
“We could not.”
Every payment processor tells you your money is safe. The question worth asking is what would happen if whoever runs it wanted it not to be. Below is what Vorixpay is structurally unable to do, the contracts that enforce it, what you are still trusting us with, and what has not been done yet.
The contracts have not had an external security audit. They are live on BNB Smart Chain and Ethereum mainnet without one. Everything else on this page rests on the code being right, and nobody independent has checked that it is. Read this page before you decide how much money to route through it.
What Vorixpay is unable to do
Each of these is enforced by a contract on-chain, not by a rule in our codebase. You can read them yourself.
Vorixpay cannot send your money to a different address
Each payment address is a clone of one contract. When it is collected it pays exactly two places: our fee to the treasury named in the registry, and everything else to the wallet you registered. There is no parameter for a destination, no owner on the address, no arbitrary call, no arbitrary delegatecall — a clone only ever delegates to the one implementation it was created with — and no upgrade path. A caller who triggers it chooses nothing except when it happens. The size of the fee is ours to set; who receives the remainder is not.
Vorixpay cannot change which wallet you are paid into
The registry only accepts a change signed by the wallet currently registered. Vorixpay submits that transaction and pays the gas, but cannot produce the signature. There is no override, deliberately — one would make this claim false.
A leaked wallet key alone cannot move your payouts
The registry accepts registrations, changes and cancellations only from Vorixpay, and each still needs a signature from your registered wallet. So someone holding just your wallet key cannot change it on-chain behind your back — they would also need your Vorixpay account — and there is no second route that could happen without us seeing it. Every change emails you and sends a wallet.change_requested webhook straight away, then waits 24 hours before it can be applied, and you can cancel it from your dashboard in that window.
An address cannot be deployed to pay someone else
The address is derived from a salt containing your own merchant key, and the factory derives that salt itself rather than accepting one. A contract at your address can only ever be initialised with your key, so it can only ever pay you.
Our online key cannot redirect money you are already set up to receive
Vorixpay keeps exactly one key online, on every network: the relayer. It pays gas for collections and submits the registrations and changes you sign, and the registry gives it nothing else — it cannot move a wallet you have already registered, cannot change the fee rate or a token’s minimum fee, and cannot point the treasury somewhere new. Those last three belong to a fee admin and an owner that are the same wallet held offline, which is why our own admin panel cannot push a fee change and we sign those by hand. Someone who stole the relayer key could not send your money anywhere but your wallet and our treasury. On a network where you have not registered yet, though, it is the key that makes first registrations, and register() only checks a signature from the wallet being nominated — so a thief could register a wallet of their own for you there first. That is why you should check that the registered address shown in your dashboard is your own wallet, on a block explorer, before relying on a network.
The contracts, on every network
Deployed and verified on BNB Smart Chain and Ethereum, and on both of their test networks. Source is readable on each explorer. The same three addresses appear everywhere — one deployer with a fresh transaction count on each chain produces identical addresses — so check which explorer you are on before reading anything into a match.
Pay3MasterRegistry
Holds the payout wallet registered against each merchant, the fee rate and the per-token minimum fee.
0xfCCCbd8a4CEeba10676d2C67Db6aA26B0d448249
Pay3DepositFactory
Derives every payment address and deploys one the first time it is collected.
0x49D1F026dB0818fF51C00c276f623c5d9E549b99
Pay3Deposit
The implementation every payment address delegates to. This is the contract that decides where your money can go.
0x1f241dd1d7f358F6CD17778B6ee6a852EaCE3044
On each of them, owner, feeAdmin and treasury are a wallet held offline. relayer is the one key we keep online. You can read all four off the registry rather than taking our word for it.
What you are still trusting us with
“Non-custodial” is often used to mean “trust us about nothing”, which is never true. Here is what it does not cover.
Being the first to claim your merchant key
Only Vorixpay can submit a first registration, so nobody outside Vorixpay can claim your merchant key before you do. A dishonest Vorixpay still could, or anyone who stole our relayer key. What neither can do is change an entry afterwards — and no payment address is issued until a wallet is registered, so you see the registered address before any money can move to it. Check it is yours on a block explorer before you hand out a single address.
Being there when you change your wallet
Because every change goes through Vorixpay, you cannot change your payout wallet while Vorixpay is unavailable. Your money keeps going to the wallet already registered, which you control, and a change you already made can be applied by anyone once its 24 hours have passed — so nothing gets stuck halfway.
Telling you the truth about what arrived
Detection, invoice status and balances are our reading of the chain. Checks run against it every five minutes and flag any disagreement for us to fix, but the dashboard is still a report rather than a source. Anything that matters is verifiable independently: every payment shows its transaction hash.
Setting a fair fee
The fee rate and the per-token minimum fee live in the registry and are set by us, from a wallet kept offline rather than from the key on our server. The rate is set per network, higher where a collection costs more gas: 1% on BNB Smart Chain, 2% on Ethereum. An invoice’s rate is fixed when it is created, but the minimum fee — and the rate on permanent customer addresses — is read when the money is collected. The contract caps neither below 100%. You are trusting us not to raise them unreasonably; every change is an on-chain event you can watch.
Keeping the service running
If Vorixpay stops sweeping, your money does not go anywhere — it sits at an address that can still only pay you, and the contracts remain on-chain and callable by anyone. Collecting it yourself needs the parameters each address was derived from, which we would export for you on request. What you would lose is convenience and gas, not funds.
What has not been done yet
The part most security pages leave out.
No external audit
The contracts have not been reviewed by a third-party security firm, and they are live on mainnet anyway. They are small and deliberately featureless — the registry has four functions a merchant uses and eight for fees, keys and ownership, none of which can change a registered payout wallet, and the deposit contract has three — but small is not the same as audited. Nothing on this page is worth more than the code being correct, and nobody independent has checked that the code is correct. Size the money you put through it accordingly, and read the contracts yourself: they are verified on every explorer below.
No production history
The mainnet contracts went live on 17 September 2026. Everything before that ran on the test networks. It is the same code that has been running there for weeks, which is worth something and is not worth as much as years of adversarial attention on a chain where the money is real.
Tron is not finished
The address derivation and chain adapter are built and tested against live Tron, but no contracts are deployed there and the collection engine has no model for Tron’s staked resources. Addresses are refused on Tron rather than issued optimistically.
Two rules that matter when you set up
Never register an exchange deposit address
Use a wallet you hold the keys to — MetaMask, Trust Wallet, a hardware wallet. Registering needs a signature from the wallet itself, and changing it later takes 24 hours, so the wallet you register is the one you will be paid into. Payouts are sent from a smart contract, and exchanges generally do not credit deposits that arrive that way.
Check the registered address on a block explorer
Once you register, verify on-chain that the entry is the wallet you control before handing out payment addresses. It takes a minute and it is the one check that makes everything on this page something you have confirmed rather than something you were told.