Non-custodial policy

This document states the engineering invariants that keep the platform outside money-transmitter / MSB scope. Changes to any invariant require legal sign-off before merge.

Invariants

• No private keys. The platform stores extended public keys (xpub / SLIP-132 / Monero primary address) only. Anything that can sign is rejected and never persisted.
• No fund flow. On-chain payments settle directly to merchant-derived addresses. The platform never sweeps, forwards, batches, or holds funds, and has no ability to do so.
• Fiat via merchant-owned accounts. Stripe is integrated through Stripe Connect. PayPal / BitPay / Circle credentials belong to the merchant’s own provider accounts. Charges settle to the merchant, never to the platform.
• Platform billing is separate. Our own subscription/usage billing runs on the platform’s Stripe account and is fully segregated from merchant payment flows.
• No exchange or conversion. The platform quotes prices but never converts, exchanges, or escrows value.

What we provide instead

Orchestration (intent lifecycle), reconciliation (watching chains and provider APIs), webhook relay, and reporting. We are a software service, not a payment processor or money transmitter.

Operational consequences

• Support staff cannot move customer funds under any circumstance.
• A full database compromise must not allow an attacker to move merchant funds (xpubs reveal addresses, not spending ability).
• Refunds on-chain are merchant-initiated from merchant wallets; the platform only records them.