We can't lose your money. We never hold it.
Most payment risk comes from one place: a processor holding your funds. PYMSTR is built so that never happens. Money settles straight to your own wallet, you hold the keys, and we control no contract. The safest pot of money is the one that does not exist.
The risk we engineered out.
We never hold your money
Payments settle straight from the customer wallet to your wallet in a single on-chain transaction. PYMSTR never receives, holds, routes, or controls the funds. There is no balance on our side to freeze, delay, or lose.
Nothing to drain
Custodial processors pool merchant money in their own wallets, which is exactly what has cost the industry hundreds of millions in hacks. We engineered that risk out: there is no pot of customer money here, so there is nothing for an attacker to take.
No keys, no switches
PYMSTR controls no contract. No admin key, no pause, no blacklist, no redirect. The most we can do is reject a payment that does not match the recipients and amounts you configured.
A bug cannot move your funds
Because the customer wallet signs the exact, validated transfers, a software error on our side cannot move or lose money. The worst case is a payment that does not go through, which is simply retried.
Built on audited public standards
The entire on-chain path is public code we did not write, and each contract that moves funds names the firm that audited it. There is no PYMSTR smart contract in the flow to trust or to break.
MetaMask Smart Account
The smart wallet every customer and merchant gets. It holds the funds and executes only what its owner signs.
Audited by Consensys Diligence (part of Consensys, MetaMask's parent company) and CyfrinERC-4337 account abstraction
The standard those smart wallets run on. We use EntryPoint v0.7, which executes only the transfers the owner signed.
Audited by OpenZeppelin (the v0.7 audit, February 2024)Pimlico singleton paymaster
Lets the customer pay gas in the stablecoin itself. Checkout gives it permission to collect that fee in the token, and the contract takes only the gas fee for the transaction it pays for. It cannot redirect a payment.
Audited by Nethermind (March 2025)USDC and USDT token contracts
The stablecoins themselves, the tokens your customers pay with.
Issued by Circle and TetherThe layer around the rail.
Signed webhooks
Every webhook is signed with HMAC-SHA256 (X-Pymstr-Signature) and carries a timestamp with a 5-minute tolerance, so you can verify it came from us and reject replays.
Scoped API keys
API keys are rate limited and can be locked to an IP allowlist. When you set an allowlist, a leaked key only works from those IP addresses.
Hardened sessions
Sessions live in Redis with sliding expiry, tokens are kept in memory rather than local storage, and five failed sign-ins within 15 minutes lock that account out from that IP address.
Locked wallet address
Once your smart-wallet address is set it cannot be changed, which closes off account-takeover by address swap.
Minimal data
We hold no funds and minimal data. Webhook payloads are reconstructed on demand from the payment record rather than stored.
Verify everything on-chain
Every payment carries its on-chain transaction hash, so you can independently confirm what happened against a public ledger.
The keys are theirs, not ours.
A customer signs in with their normal Google, Apple, or email login and a MetaMask Smart Account is created for them automatically. Its key is protected by MPC key shares through Web3Auth that PYMSTR never holds, and it is only put back together on their own device. We cannot touch the funds, and recovery never depends on us.
- If PYMSTR is ever offline, recovery.pymstr.com lets any customer or merchant move their funds out from their own browser. The key is exported at account.web3auth.io and goes into MetaMask; the tool never asks for it.
- MFA is off by default. A customer who turns it on at account.web3auth.io can rebuild their key from their own shares, without Web3Auth's servers.
- Customers can sign in with their own wallet, such as MetaMask. It signs for a smart wallet of their own, which they fund before paying.
- Merchants can send their funds on from the dashboard to any address they choose, such as a Safe they already use.
You keep control of compliance
PYMSTR is payment infrastructure, not a processor that handles your customers' money. You hold the relationship with your customers, so screening stays with you, and we make that practical: every payment carries its on-chain transaction hash, so you can screen the payer with your own provider (Chainalysis, Elliptic, TRM) on your own rules, before or after payment.
How that responsibility is allocated is set out in the Merchant Agreement. For the architecture behind all of this, see how non-custodial works.
Straight answers. No hand-waving.
Security questions.
No. PYMSTR is non-custodial infrastructure. The customer wallet signs the payment and the funds move directly to your wallet on-chain. We never take possession or control of the money at any point.
The safest money is the one we never touch.
Non-custodial. Stable-in, stable-out. Funds settle directly to your wallet on-chain, in seconds. Add it next to your card processor and start accepting in minutes.