Security
Security at every layer
Moving money for Web3 and iGaming platforms means being a target. Here is how we protect your funds, from the API request down to the chain.
Signed, locked-down API
- Every request is signed with HMAC-SHA256 and your secret never travels over the wire
- Timestamps must be within 5 minutes and each signature works only once, so captured requests can't be replayed
- Each API key only accepts calls from the IP addresses you register
- Every failure returns the same response, so attackers learn nothing
Isolated key management
- Private keys live only in a dedicated signing service, never in the API or in application code
- The signer only signs transactions that match strict allowlist rules
- On EVM networks, deposit addresses are smart contracts that can only forward funds to your vault
Payout controls
- Per-transaction and daily limits on every merchant account
- Manual approval above a threshold you choose
- Idempotent request ids: a retried payout is never sent twice
- Payouts can be paused instantly if anything looks wrong
Double-entry ledger
- Every movement of funds is recorded as balanced double-entry journal lines
- The database itself refuses unbalanced or negative entries
- Posted entries can't be edited or deleted, giving a complete audit trail
- Deposits are credited only after network finality, with reorgs handled automatically
Trustworthy webhooks
- Every event is signed so you can verify it came from us
- Delivered only to HTTPS endpoints, with private and internal addresses blocked
- Each event has a unique id, so you can safely deduplicate retries
Hardened infrastructure
- Production access is restricted to allowlisted networks and fully audited
- No public SSH; administrative access goes through audited sessions
- Changes to secrets, keys and system configuration raise alerts immediately
- Continuous monitoring with real-time alerts to our operations team
Our guarantee
If our system fails, we carry the loss. Not you.
If funds are lost because of a fault in iCryptoNow's own platform, we cover it in full. Your players are credited and your balance is made whole, at our cost.
We cover
- Faults in our address generation, signing, sweeping and payouts
- Breaches or failures of our servers and infrastructure
- Errors in our ledger or balances
Outside our scope
- API calls made with your keys if they leak from your systems
- Deposit addresses changed or replaced on your platform
- Anything else that happens on your side of the integration
Your part of the setup
Our guarantee covers our systems. These steps keep your side just as safe.
Keep secrets server-side
Store your API and webhook secrets in a secrets manager. Never ship them to browsers or apps.
Register only your servers
Allowlist only the outgoing IPs of the servers that call our API.
Verify every webhook
Check the signature and timestamp before crediting a player, and deduplicate on event_id.