Custody & security
Not “we would never”.
“We could not.”
Every payment processor tells you your money is safe. The question worth asking is what would happen if the company wanted it not to be. Below is what Vorixpay is structurally unable to do, what you are still trusting us with, and what has not been done yet.
What Vorixpay is unable to do
Each of these is enforced by a contract on-chain, not by a rule in our codebase. You can read them yourself.
Vorixpay cannot send your money to a different address
Each payment address is a clone of one contract. When it is collected it pays exactly two places: our fee to the treasury named in the registry, and everything else to the wallet you registered. There is no parameter for a destination, no owner on the address, no arbitrary call, no arbitrary delegatecall — a clone only ever delegates to the one implementation it was created with — and no upgrade path. A caller who triggers it chooses nothing except when it happens. The size of the fee is ours to set; who receives the remainder is not.
Vorixpay cannot change which wallet you are paid into
The registry only accepts a change signed by the wallet currently registered. Vorixpay submits that transaction and pays the gas, but cannot produce the signature. There is no override, deliberately — one would make this claim false.
A leaked wallet key alone cannot move your payouts
The registry accepts registrations, changes and cancellations only from Vorixpay, and each still needs a signature from your registered wallet. So someone holding just your wallet key cannot change it on-chain behind your back — they would also need your Vorixpay account — and there is no second route that could happen without us seeing it. Every change emails you and sends a wallet.change_requested webhook straight away, then waits 24 hours before it can be applied, and you can cancel it from your dashboard in that window.
An address cannot be deployed to pay someone else
The address is derived from a salt containing your own merchant key, and the factory derives that salt itself rather than accepting one. A contract at your address can only ever be initialised with your key, so it can only ever pay you.
Our online key cannot redirect money you are already set up to receive
The key Vorixpay keeps online pays gas for collections, submits the registrations and changes you sign, and sets the fee rate and per-token minimum fee. Someone who stole it could not send your money anywhere but your wallet and our treasury, and could not change a wallet you have already registered — that still needs your wallet’s signature and the 24-hour delay. On a network where you have not registered yet, though, it is the key that makes first registrations, so a thief could register a wallet of their own for you there first. That is why you should check that the registered address shown in your dashboard is your own wallet, on a block explorer, before relying on a network. They could also raise the fee until we replaced the key with our offline owner key — which would cost you money, but not send it to them.
What you are still trusting us with
“Non-custodial” is often used to mean “trust us about nothing”, which is never true. Here is what it does not cover.
Being the first to claim your merchant key
Only Vorixpay can submit a first registration, so nobody outside Vorixpay can claim your merchant key before you do. A dishonest Vorixpay still could, or anyone who stole our relayer key. What neither can do is change an entry afterwards — and no payment address is issued until a wallet is registered, so you see the registered address before any money can move to it. Check it is yours on a block explorer before you hand out a single address.
Being there when you change your wallet
Because every change goes through Vorixpay, you cannot change your payout wallet while Vorixpay is unavailable. Your money keeps going to the wallet already registered, which you control, and a change you already made can be applied by anyone once its 24 hours have passed — so nothing gets stuck halfway.
Telling you the truth about what arrived
Detection, invoice status and balances are our reading of the chain. Checks run against it every five minutes and flag any disagreement for us to fix, but the dashboard is still a report rather than a source. Anything that matters is verifiable independently: every payment shows its transaction hash.
Setting a fair fee
The fee rate and the per-token minimum fee live in the registry and are set by us. An invoice’s rate is fixed when it is created, but the minimum fee — and the rate on permanent customer addresses — is read when the money is collected. The contract caps neither below 100%. You are trusting us not to raise them unreasonably; every change is an on-chain event you can watch.
Keeping the service running
If Vorixpay stops sweeping, your money does not go anywhere — it sits at an address that can still only pay you, and the contracts remain on-chain and callable by anyone. Collecting it yourself needs the parameters each address was derived from, which we would export for you on request. What you would lose is convenience and gas, not funds.
What has not been done yet
The part most security pages leave out.
No external audit
The contracts have not been reviewed by a third-party security firm. They are small and deliberately featureless — the registry has four functions a merchant uses and eight for fees, keys and ownership, none of which can change a registered payout wallet, and the deposit contract has three — but small is not the same as audited. Do not put mainnet funds through this until that has happened.
Testnet only
Deployed and working on BNB Smart Chain Testnet and Ethereum Sepolia. Nothing is on mainnet yet.
Tron is not finished
The address derivation and chain adapter are built and tested against live Tron, but no contracts are deployed there and the collection engine has no model for Tron’s staked resources. Addresses are refused on Tron rather than issued optimistically.
Two rules that matter when you set up
Never register an exchange deposit address
Use a wallet you hold the keys to — MetaMask, Trust Wallet, a hardware wallet. Registering needs a signature from the wallet itself, and changing it later takes 24 hours, so the wallet you register is the one you will be paid into. Payouts are sent from a smart contract, and exchanges generally do not credit deposits that arrive that way.
Check the registered address on a block explorer
Once you register, verify on-chain that the entry is the wallet you control before handing out payment addresses. It takes a minute and it is the one check that makes everything on this page something you have confirmed rather than something you were told.