Company
How Tidepay handles custody, keys, and subscriber data.
Tidepay never holds subscriber funds. Subscribers grant an on-chain ERC-20 allowance to Tidepay's operator contract when they subscribe; charges execute as a direct transferFrom pull from the subscriber's own wallet to the merchant's (and, where configured, the platform's) address in a single on-chain transaction. There is no intermediate wallet holding customer balances.
The operator private key that executes scheduled pulls is held in a secrets manager, never checked into source control or logs, and is scoped to only the transferFrom and split operations the billing engine needs — it cannot move funds beyond what a subscriber has explicitly approved.
Every webhook is signed with HMAC-SHA256 over the request timestamp and raw body, sent as the X-Tidepay-Signature header, so merchants can verify a payload actually originated from Tidepay before acting on it. We also validate merchant-configured webhook URLs against private and internal IP ranges before every delivery attempt, to prevent our own infrastructure being used to reach internal services.
Dashboard accounts support two-factor authentication (TOTP) in addition to password login. API keys are shown once at creation and stored hashed — if a key is lost, generate a new one and revoke the old.
Passwords are stored as salted hashes, never in plain text. On-chain wallet addresses and transaction data are, by nature of the blockchains we operate on, publicly visible — Tidepay does not control the visibility of on-chain data. See our Privacy Policy for the full list of what we collect and why.
If you believe you've found a security issue in Tidepay, email security@tidepay.cc with details. We ask that you give us a reasonable window to investigate and address the issue before any public disclosure.