Security designed in, not bolted on.
How we keep your funds, your customers' data, and your day-to-day operations in good order — described in plain language, without acronym salad.
Hosted checkout
Your store never sees crypto addresses, private keys, or any payment-instrument data. PCI scope sits on us, not on you.
HMAC-signed webhooks
Every callback signs the raw body plus a Unix timestamp. ±300s replay window. Tamper or replay and verification fails closed — your order doesn't credit.
SSRF-protected webhook delivery
Outbound callbacks resolve and pin the destination IP at validate-time. Internal-network targets and known private ranges are rejected.
Non-custodial by design
Receiving addresses are derived from your own xpub, so customers pay you directly on-chain. We hold no keys and no balances — there is no pot of merchant funds here to lose.
Frequently asked.
Do you custody customer crypto?+
No. You register an extended public key (xpub) and we derive a fresh receiving address from it per invoice. Your customer pays that address directly, so the funds are in your wallet the moment the transaction confirms. We never hold them and we never have the private keys.
What happens to my funds if Geat.io has an incident?+
Nothing. Your money was never in our hands — it went from your customer to an address only you can spend from. An outage can delay invoice creation and webhooks; it cannot touch coins you already received.
How do you verify webhooks?+
HMAC-SHA256 over the raw request body and a Unix timestamp, with the secret you set per profile. Sample verification code lives in each of our SDKs. Replay-protected via ±300s timestamp window.
Where does my data live?+
Production hosting is being finalised, and we would rather name no jurisdiction than name one we have not deployed into. EU-based hosting is the plan; this answer will state the live arrangement, including where backups sit, once it is in place. The privacy policy tracks the same question.