Security
How PollyPay is built, what it can and cannot do, and how to tell us when it is wrong.
Report something
Email security@pollypay.uk with steps to reproduce. We reply within three working days. Please do not test against other people's records or run denial of service tests. There is no paid bounty today, and we credit you if you want that.
What a record is
A fingerprint and a time on a public ledger. The fingerprint is worked out on your device and cannot be turned back into the file. Anyone can check a record against the ledger without trusting PollyPay: every certificate offers a proof pack with the transaction, the memo and plain instructions for doing that.
Who signs
Ledger lines are written by PollyPay's own key, which pays the small network fee. That wallet holds fee money only, never yours, and like every wallet its balance is public. Your passkey or email sign-in proves the record is yours in our records; it never touches the ledger.
Sign in
An emailed link or a passkey. No passwords anywhere. Session cookies are random, stored only as a hash, marked Secure and HttpOnly, and expire after 30 days of inactivity or 90 days absolute. Sign-in links and every other link we send are single use and expire. You can see and end every session from your account page, and we email you when a new browser signs in while others are already signed in.
Kept copies
A copy is re-fingerprinted when it arrives and refused if it is not the recorded file, so a download is known to be that exact file. Copies are private by default, served only as downloads, never rendered in the browser, never executable, and limited in size. Share links for private copies expire when you say. A sealed note stays private until the moment you chose.
Handovers and countersigns
Links are random, single use, stored only as a hash, and expire. Accepting or signing claims the request in one step, so two people cannot both succeed. Emails we send on your behalf are capped per hour and per recipient.
Content
Everything a person types is stored and shown as plain text. Photos and logos are limited in type and size and served with headers that stop them running as anything else. Pages carry a strict content policy and cannot be framed, except the small embed badge, which carries no cookies and can do nothing.
The balance
Top-ups are in USDC. PollyPay can only take a penny from the balance for a record past the free allowance; it cannot send your balance anywhere. If you top up with a passkey wallet, Privy holds that wallet's key in pieces that only join in your own browser. If you use your own wallet, its keys were never anywhere but with you.
Records of changes
Every sign-in, key, webhook, handover, countersign and account change writes an append-only audit record. Ask us for your own entries at security@pollypay.uk if you suspect a sign-in you did not make.
Questions: hello@pollypay.uk. Abuse and impersonation: abuse@pollypay.uk. Security: security@pollypay.uk.