Security
How we protect your money, in plain English.
You should not need a security degree to judge whether a payments app is careful. Here is what we do, without the jargon.
What happens behind the screen
We cannot read your password
We keep only a one-way scrambled version, made with a slow, memory-hungry method (Argon2id) that makes guessing expensive. Even someone holding a copy of our database cannot simply read passwords out of it.
An optional second lock
Turn on two-step sign-in with an authenticator app. After that, a stolen password is not enough to get into your account. We recommend it.
Identity is checked once
Before you can send or withdraw, a specialist verification partner checks a government ID. It keeps impostors out of the network.
Card numbers never reach our servers
Card details are typed into a secure form run by Stripe, a payments company that is certified to the strictest card-industry standard. We only learn whether the payment worked.
Sessions end, and risky actions re-check you
Sign-ins expire after inactivity. Sending money, withdrawing and changing security settings on the website ask for your password again. You can see where you are signed in and sign out any device.
Money cannot be double-counted
Each payment is processed so the same request cannot be applied twice, and a balance cannot go below zero. Every movement is written to a record that is only ever added to.
Payment partners are verified
Messages from payment providers are accepted only if their cryptographic signature checks out, so nobody can fake a deposit.
Our own team is locked down too
Staff accounts need a second factor, their tools live on a separate system, and every administrative action is written to a tamper-evident log.
What we ask of you
- Use a long, unique password, or a password manager.
- Turn on two-step sign-in.
- Never share a sign-in code, password or PIN with anyone, including us. We will never ask.
- Check the recipient's name on the review screen before you confirm. Transfers between wallets cannot be undone.
- Open Monk Pay only from the address you know. Our app address is https://app.monkpay.io.
Independent testing and reporting a problem
[[TODO: once an independent penetration test has been completed, state the month and firm here. Delete this paragraph if none has been done. Do not claim a test, certificate or audit that has not happened.]]
Found a security problem? Please tell us first: info@monkpay.io. We read every report, and our security.txt lists the same contact.
Your money, handled carefully.
Open an account and turn on two-step sign-in in under three minutes.