Security model

What NervixPay can and cannot touch: no custody, no private keys, email-locked receiving addresses, on-chain verification and scoped API keys.

What NervixPay never touches

Your funds. Customers pay your wallet directly. There is no NervixPay balance to hack, freeze or withdraw.
Private keys and seed phrases. Never requested, never stored. Wallet connection reads your public address and asks for a message signature.
Your customers' wallets. The checkout shows a QR code and an address; the customer approves the transfer in their own wallet.

The server reads the blockchain itself. A browser, a screenshot or a message from the checkout page can never mark an order paid.
Only transfers of the exact amount (or the unambiguous round price) to your confirmed address, on the chosen network and coin, in a final block count.
Hosted checkout orders expire after 15 minutes so stale amounts cannot collide.

Receiving addresses are locked per network; every change needs a code sent to your account email. See wallets and receiving networks.
API keys are approved in the browser, limited by scope, expire and can be revoked. Test keys cannot create payable links.
Webhooks are signed with HMAC-SHA256 and time-stamped, and are only delivered to public HTTPS endpoints.
Customer details you pass (ref, email) are visible only to you, never on the public checkout or PayScan.