Security

Verified properly. Held safely.

Your money sits with a regulated partner in your name, every customer is verified, and every sensitive action needs a second factor.

Your money is never with us

Accounts, conversion, custody and payouts are provided by Bridge, a Stripe company, in your name. HermodPay never receives, pools or holds customer funds.

Every customer is verified

Each person and business passes identity or business verification with Bridge before money moves. Documents go straight to Bridge and its verification partners, never through our servers.

Two-factor, everywhere

An authenticator app is required for every customer and every staff member. Adding a destination or sending from a wallet asks for a fresh code.

New destinations wait 24 hours

New bank accounts and wallet addresses unlock after a 24-hour waiting period, and you get an email every time one is added. If it wasn't you, you have time to stop it.

Under the hood

The controls you don't see.

Data separation
Database rules make sure each customer can only ever see their own records.
Masked bank details
We store only the last four digits of bank accounts.
Audit trail
Every staff action and every sensitive customer action is logged.
Unusual activity
Rule-based monitoring flags sudden volume spikes, many new destinations or unusual payer patterns for review.
Rate limits
Sign-in, password reset and money actions are rate-limited against automated attacks.
Verified webhooks
Every status update from Bridge is checked against its signature before we act on it.
Daily reconciliation
Every night our records are compared with Bridge's, and any difference is investigated.
Encrypted in transit
All traffic uses HTTPS with strict transport security.
Questions

What people ask.

What happens to my money if HermodPay stops operating?

Your funds are held by Bridge in your name, not by HermodPay, so they are not part of HermodPay's own assets. Access to your Bridge account is governed by Bridge's terms.

Are stablecoin balances insured?

No. Stablecoins are not bank deposits and are not covered by the FDIC or any other deposit insurance scheme. Their value depends on the issuer's reserves.

Will you ever ask for my password or codes?

Never. HermodPay staff will never ask for your password or authenticator codes, by email, phone or chat.

How do I report a security issue?

Email support@hermodpay.com with the subject 'Security'. Urgent account issues are answered within 15 minutes at any time.

Stop waiting for your own money.

Applying takes about ten minutes. A person reviews every new account.