Account
Security & recovery
How coins on Crypto Merchant are protected, and how they can be recovered if something goes wrong.
Custody
Crypto Merchant is a custodial service. We hold the keys to your pool wallet and deposit addresses and move coins on your instructions. A ledger records which coins belong to which business.
One master recovery phrase
Every wallet on Crypto Merchant is derived from one master recovery phrase, using the open BIP-39 and BIP-44 standards. Each business has its own account number under that phrase, so its addresses are separate from every other business.
The phrase is written on paper and kept offline by the operator. On the server, it is stored only in encrypted form.
If servers are lost
Because every address follows a standard derivation path, all addresses and their keys can be rebuilt from the recovery phrase on new hardware, even if every server is lost.
Protect your account
- Use a strong password that you don't use anywhere else. Passwords are stored only as a secure hash.
- Turn on two-factor sign-in with an authenticator app.
- Give each team member the lowest role they need. See Team roles.
- Keep API keys and webhook secrets on your server, and revoke any key you think has leaked.
- Double-check payout addresses. Crypto transfers can't be reversed.
Report a problem
If you notice anything wrong with your account or a payment, write to [email protected]. We will never ask for your password or your two-factor codes.