How Affiliate Pay keeps payouts safe

Last updated: 1 November 2026

Affiliate Pay moves money for other people, so it is built on one rule: we never hold your funds, and nothing we run can pay someone you did not approve. This page explains how.

Non-custodial by design

• Your wallet signs every payment. We prepare, verify and track transactions; the money goes straight from your wallet to your recipients. We cannot move it.
• Automatic payouts stay within on-chain limits. When you let payouts run on their own, the limit per period lives in a smart contract you control, and you can revoke it from your wallet at any time.

Protections on-chain

• Each batch can pay only once. Our contracts check the network, an on-chain deadline and a single-use reference, so a late or repeated signature reverts instead of paying twice.
• No admin keys. The contracts have no owner, no upgrades and no pause, and keep no funds or allowances after a batch.
• External audit before mainnet. Mainnet opens only after an independent audit of the contracts.

Verified on the blockchain

• Two independent nodes. A payout counts as sent only when two nodes run by different operators show exactly the batch that was approved, in the same block.
• Nothing is released on a guess. If a transaction might still land, its payouts stay locked until the chain proves otherwise, so a recipient is never paid twice.

Approvals you control

• Two-factor authentication on every action that moves money, with a fresh code for sensitive changes.
• Four eyes. Require a second approver, and set daily and per-payout limits.
• Brute-force protection. Password and 2FA attempts are limited per account.

Records nobody can quietly change

• Sealed payouts. Every payout and transaction carries a seal made with a key held in a hardware security module. If a record is changed outside the application, it does not pay and everything stops.
• Append-only audit log. Every action is recorded in a hash-chained log that the database itself refuses to edit or delete.

Keys and secrets

• Hardware security modules. The keys that sign automatic payouts and claim links live in a cloud HSM and never on our servers.
• Encrypted secrets. Exchange keys, 2FA secrets and webhook secrets are encrypted with master keys that only the HSM can unlock.

Screening before money moves

• Sanctions. Every destination is checked against the OFAC sanctions list before it is paid.
• Fraud. Optionally, each payout is screened with CashoutGuard: multi-accounts, device farms and VPN abuse wait for review instead of cashing out.

API and integrations

• Locked-down API keys. Keys are stored hashed. Live keys that can create or execute payouts work only from the IP addresses you allow.
• Signed webhooks. Every webhook is signed so your backend can verify it came from us, and we never call private network addresses.
• Idempotency keys on every write, so a retried request never creates a payout twice.

Infrastructure

• A dedicated server for Affiliate Pay, with the application database role unable to change its own schema or history.
• Encrypted off-site backups that cannot be deleted before their retention ends: the database every day and the audit log every hour.
• An emergency stop that halts every payout at once, and alerts when anything looks wrong.

Reporting a vulnerability

If you find a security issue, tell us through the contact form with the word "security" in the message. Please give us time to fix it before making it public. We do not take action against good-faith research.