Skip to content
Security

How BluPay protects funds and accounts

Custody is a responsibility we take seriously. Here is exactly how keys, accounts, and the platform are secured — and how to report an issue.

Custody

  • Deposit and treasury keys are derived from a master seed that lives only inside an isolated signer (OpenBao) — never on application servers or in the database.
  • The signer is sealed at rest and unsealed operationally; the master seed is never logged or exposed to the API.
  • Withdrawals require a fresh email code and a 2FA token, and are reviewed before broadcast.

Accounts

  • TOTP two-factor authentication is required to withdraw and is available on every account.
  • Passwords are hashed with bcrypt; 2FA secrets are encrypted at rest with AES-256-GCM under a dedicated key.
  • Sessions use rotating refresh tokens with replay protection.

Platform

  • Webhooks are signed with HMAC-SHA256 so you can verify every callback is genuinely from BluPay.
  • Every balance change is written to an append-only ledger — balances are auditable, not mutable.
  • API keys are scoped per shop and support an optional IP allow-list.
  • All traffic is served over TLS; the API sits behind a rate limiter.
Responsible disclosure

Found a vulnerability?

We welcome reports from security researchers. Email security@blupay.me with details and reproduction steps. Please give us a reasonable window to remediate before any public disclosure, and avoid accessing accounts or data that are not yours.

[ FILL: add PGP key / bug-bounty program / response SLA here if you have them ]