Security: how your keys and your data are protected

Your keys: a key in two parts

In the planned self-custody wallet the key is split in two parts. One part lives on your phone. The other is held by the wallet service. Signing a payment needs both parts.

• A break-in on our side is not enough to move your crypto.
• Zeltis cannot move your crypto without you.
• You will be able to export your key and use another compatible wallet.

If you lose your phone

You will set up a recovery method when you create the wallet. With it you can restore the wallet on a new phone.

Without the phone and without the recovery method, nobody can restore the wallet, including us. That is the price of holding your own key, and the app will help you set up recovery on the first day.

Your data: encrypted before it is stored

• Email addresses, names, company names and messages are encrypted in our application (AES-256-GCM) before they are written to the database. The database provider encrypts the storage again.
• The database is located in the European Union.
• We do not store your IP address.
• We ask for the minimum: an email address, and a country if you want to give one.
• You can remove your email at any time with the removal link in our email.

The full description is in the Privacy notice.

Our staff: two steps and a log

• Only named members of staff can read the entries, and their rights depend on their role.
• Staff sign in to our back office in two steps; the second is a one-time code.
• Every time staff open a list, export it or change an entry, the action is written to a log that shows any later alteration.
• A second log of the same kind records every sign-in to the back office, every request the site refuses and every attempt to probe it. It holds no full IP address.

This website

• No advertising scripts and no fonts loaded from other companies. Visit statistics are collected only if you accept them.
• Every page is served over an encrypted connection, and a strict content policy tells your browser which scripts may run.
• The demo app asks for no personal data. Its balances, cards, account details and transfers are simulated.

Checks the law requires

You will verify your identity before using the card and the euro account, and transfers will be screened, as at any payment company. We will say up front what is needed.

The partner institutions that provide the card and the euro account can pause them while they review something. If that happens, your crypto is still in your wallet.

What security cannot do

• It cannot bring back a wallet when both the phone and the recovery method are lost.
• It cannot stop a partner institution from pausing the card or the euro account it provides.
• It cannot protect the value of what you hold. Prices can fall.

Found a problem? Tell us

Security researchers can reach us at security@zeltis.money. The same contact is in our security.txt file, and the rules for reports are in the legal notice. We will not take legal steps against researchers who act in good faith and follow these rules.