Protection you can understand

Clear boundaries for your money

Send funds only when your signed-in account shows valid payment instructions for your order. Check the network, amount and expiry before sending. A payment is settled only when it has been confirmed.

Account access

Your password is stored as a salted Argon2id hash, not as readable text. The server requires 8–128 characters and rejects common or predictable choices. It also checks request origins and limits repeated sign-in attempts.

Your signed-in session uses an HttpOnly, SameSite=Strict cookie; the server maintains the session record. Sessions expire after eight hours. Signing out ends the current session. Changing your password ends other sessions; a password reset ends all sessions and requires a fresh sign-in.

Before each top-up

When a top-up is available, the payment quote shows the selected USDT network, card credit, service fee, route fee and total. Your sending wallet or exchange may charge separately. Credit is posted after the transfer and provider confirmation.

Email codes and account recovery

Password recovery uses a one-time code. Delivery depends on the account environment. Email confirmation, email sign-in codes and email changes are not connected.

Codes contain eight digits, expire after ten minutes and work only once. Requests and incorrect attempts are limited. Email changes will require a separate verified process before they become available. If you lose access to the registered mailbox, we cannot recover the account or bypass email confirmation.

Email codes add a sign-in step; they do not make an account immune to phishing. Protect your mailbox as carefully as your ZePay password.

What still needs a live provider

Card freezing, mobile-wallet setup and access to live card details depend on provider capabilities. Production hosting, HTTPS, access controls, incident handling and custody arrangements must be established before launch.

Protect your side of the account

Use a unique password or passphrase, keep your email account protected and sign out on shared devices. Never send a seed phrase, private key, password or full card details to support. Before any future live transfer, check the exact network and address in your authenticated account.

Report a concern

Write to ZePayCrypto@proton.me with a description of the issue and the page or action involved. Remove secrets and personal details from screenshots. Response times and a production incident-response process have not yet been published.