Security
Security starts with what we don't hold.
The simplest way to protect your money is not to hold it. ProofPay is designed so that Vivid Coding never takes custody of user funds.
Non-custodial by design
ProofPay doesn't keep user balances, pooled accounts, or reserves of customer bitcoin. Payments are sent over the Lightning Network through Strike when a task is verified. Since we never hold your funds, there's no pile of user money on our side for anyone to target.
Built on Strike
Instead of building and running our own payment system, ProofPay uses Strike's Lightning payment infrastructure. Strike's handling of accounts and payments is governed by Strike's own terms and policies. [Link to Strike's relevant terms and policies.]
How we approach security
- Collect only what we need. We ask for only the information required to run the service.
- Least privilege. Access to systems and data is limited to what each role requires.
- Secure development. We use code review, keep dependencies up to date, and handle secrets carefully. [Adjust to reflect actual practices.]
- Encryption in transit. Our website and app connections use HTTPS/TLS. [Confirm; add encryption at rest only if implemented.]
- Plain disclosure. If something goes wrong that affects you, we'll tell you clearly and promptly.
What you can do
- Use a strong, unique password and turn on two-factor authentication wherever it's offered.
- Keep the accounts and devices you use to receive bitcoin secure.
- Be wary of anyone asking for your passwords, recovery phrases, or verification codes. Vivid Coding will never ask for them.
- Only use official links from vividcoding.com and the official ProofPay app.
Report a security concern
If you think you've found a vulnerability or a security problem, email keith@vividcoding.com with the subject line "Security Report." Please include enough detail for us to reproduce the issue, and give us reasonable time to fix it before disclosing it publicly. [Optional: add a formal responsible-disclosure policy.]