Security and control

Built to observe payments,
not control funds.

MainPay is non-custodial. Funds move directly from a payer to a merchant-controlled address; MainPay does not become a party to that transfer.

What MainPay can and cannot do

MainPay canMainPay cannot
Read public blockchain transfer and confirmation dataSign, send, freeze, or reverse a transfer
Match observed transfers to an order, invoice, or income recordHold funds, operate a pooled balance, or off-ramp assets
Send signed webhooks and operational notificationsAccess seed phrases, private keys, or withdrawal-enabled credentials
Store operational records for the workspaceReverse an on-chain transfer or make a payer whole

What we read and store

To monitor a workspace, MainPay reads public receiving addresses and the supported USDC and USDT transfer data associated with them, including transaction hashes, source and destination addresses, stablecoin amounts, network, block time, and confirmations. We store those observations alongside the workspace's operational records, such as invoice or order context, labels, reconciliation state, audit events, and webhook delivery status.

Access and secrets

Passwords are hashed with Argon2 and browser sessions use secure, HTTP-only cookies. API keys are shown once, stored as hashes, scoped to a workspace and mode, and revocable. Webhook signing secrets are shown only when created or rotated; MainPay stores the active signing secret so it can authenticate deliveries with the documented t=,v1= signature scheme. Workspace roles restrict owner-only changes, and accountant access is read-only.

Confirmations and chain changes

Receiving wallets have configurable confirmation thresholds. MainPay records the observed transaction and its confirmation state before treating a payment as confirmed. Chain reorganizations and other chain changes can affect what a provider reports, so MainPay keeps the on-chain transaction evidence attached to the operational record for review; it is not a finality guarantee.

We never need

Report vulnerabilities privately to security@mainpay.com.