Security

Verifiable, Not Just Reassuring

We avoid phrases like bank-level security, because they can't be checked. Instead, here is exactly how the system is built, what you can verify yourself on-chain, and what we haven't finished.

Architecture

You Hold The Wallet

Non-custodial by design

Every user has their own ERC-4337 smart contract wallet on Avalanche C-Chain. Our relayer can only execute calls the wallet authorises. It never holds your funds.

Escrow, not a black box

Money sent to a non-user sits in an on-chain escrow contract with a fixed 7-day expiry and automatic refund. That's enforced by code, publicly.

Privacy-preserving lookup

The phone-to-wallet registry stores a one-way hash of the number, never the number itself.

Gasless transactions

A paymaster sponsors network fees, so you don't need to manage a gas balance to protect your access to your own money.

Transparency

What You Can Check Yourself

Every transaction (wallet addresses, amounts, timestamps) is recorded publicly on Avalanche. Your personal identity is not: phone numbers only ever appear on-chain as one-way hashes.

Settlement is multi-asset in USDC and USDT, both pegged 1:1 to the US dollar, plus native AVAX. AutoPayKe runs on Avalanche mainnet, see "What Isn't Done Yet" below for what still has to close out, including the independent security audit.

Honest gaps

What Isn't Done Yet

We update this section as each item closes.

Smart contract audit

Outstanding

An external audit has not been completed. It's on the roadmap and the report will be published when it exists.

Identity verification

Outstanding

We collect KYC details but full document and liveness verification with a licensed vendor is not yet integrated, so we don't claim verified identity.

Licensing

In progress

PSP licensing with the Central Bank of Kenya and ODPC data protection registration are in progress, not complete.

Recipient name checks

Rail limit

No rail we use supports recipient-name verification today. Always confirm the number before you send.

Your phone number is all you need

Create your account with your phone number. You're sending in minutes.