Security
Non-custodial by architecture, not by promise
The strongest security property here is not something we promise to do well. It is something the system cannot do at all: Unheld never holds the keys that move your money, so a breach of Unheld cannot spend it. Everything below explains why that is structural, and where the real risks remain.
Where your keys are, and are not
Your wallet is generated in your browser. The secret recovery phrase is created there, shown to you once, and never transmitted — there is no request that carries it, so there is no server-side copy to leak. What Unheld receives is the public, watch-only part of your wallet: enough to recognise your addresses and read what arrives on them, and not enough to authorise a single transaction.
The practical consequence is worth stating bluntly: if someone took a complete copy of everything Unheld stores, they still could not move your funds. They would learn which addresses are yours and what has arrived on them, which is a privacy problem, not a solvency one.
What a compromise of Unheld would and would not reach
Could be exposed
- Which addresses belong to you, and the payments that arrived on them.
- Invoice metadata you chose to store, and customer records you created.
- Webhook endpoints and their signing secrets, until you rotate them.
Could not happen
- Your funds being spent, moved or frozen — the keys are not here to steal.
- Your recovery phrase being read from our systems; it was never sent to them.
- A payout being redirected mid-flight; payments go to your address, not through us.
You can leave with everything
Your recovery phrase opens the same wallet in any standard wallet software. If this account vanished tonight, the funds on your addresses would be spendable tomorrow with no involvement from us. That is the test worth applying to any payments provider: not whether they promise to behave, but whether their misbehaviour could cost you anything.
What self-custody means for you
- A lost recovery phrase is unrecoverable. Nobody here has it, so no support route can restore it. This is the cost of the property described above, not an oversight.
- On-chain payments are final. Sending to the wrong address, or on the wrong network, cannot be undone by us or by anyone.
- Your browser and device are part of the security boundary. A compromised machine at the moment of wallet generation is a risk no amount of server-side care can remove.
Nobody at Unheld will ever ask for your recovery phrase. Any message that does is not from us, regardless of how it looks.
Reporting a vulnerability
Report privately first, to the address below. We will not pursue legal action against researchers acting in good faith who avoid accessing other people’s data and do not degrade the service for others. A machine-readable contact is published at /.well-known/security.txt.
Security contactsupport@unheld.io
Security questions merchants ask
What happens to my money if Unheld is breached?
Nothing — the keys that move your funds are not stored here, so there is nothing to steal that would let anyone spend them. A breach would expose which addresses are yours and what arrived on them, which is a privacy problem rather than a solvency one.
Can Unheld freeze my funds or block a payout?
No, because there is no payout step to block — payments settle directly to your own address, never through an Unheld balance. There is no account holding your money, so there is nothing for us to freeze, delay or reverse.
What happens to my money if Unheld shuts down?
Your funds stay exactly where they are, on addresses only your recovery phrase controls. That phrase opens the same wallet in any standard wallet software, so you can keep spending with no involvement from us.
Does Unheld ever see my recovery phrase or private keys?
No — your wallet is generated in your browser and the recovery phrase is never transmitted. Unheld receives only the public, watch-only part: enough to recognise your addresses and read what arrives, and not enough to authorise a single transaction.
What happens if I lose my recovery phrase?
The funds are unrecoverable, and no support route can restore them. Nobody at Unheld holds that phrase — the same property that stops a breach spending your money — so this is the cost of self-custody, stated plainly rather than hidden.
Has Unheld had a third-party security audit?
No. There is no third-party security audit and no completed penetration test, and this page says so rather than implying assurances that do not exist. What you can verify yourself is the architecture: generate a wallet on testnet and watch what does and does not leave your browser.
Check it yourself on testnet
Generate a wallet, watch what leaves your browser, and confirm a payment arrives at an address you control — before any real money is involved.
Start free