Security & trust
How Stablora protects your funds
What we hold, how keys are protected, how payments are verified — and what you should check before you integrate any payment gateway, including this one.
Custody model
- Stablora is a custodial gateway: customer payments are received on addresses the platform controls, and your balance is a claim recorded in our ledger until you withdraw it.
- Every order gets its own deposit address, derived from HD wallets (BIP-32/44/84, SLIP-10). Credited funds are swept into a hot wallet per network, from which payouts and refunds are sent.
- Balances are kept separately per network and asset: USDT on TRON is never mixed with USDT on Ethereum.
Private keys
- The web application and API servers never hold private keys. They only know public keys (watch-only).
- Signing happens in an isolated signer process under its own system user. It enforces its own rules: sweeps only to our hot wallet, payouts capped per transaction and per day, conversions only through allow-listed DEX routers with an independent price check.
- A compromised web server therefore cannot send funds to arbitrary addresses or above the signer limits.
Accounting
- Every balance change is a double-entry journal in integer base units (no floating point), applied atomically and idempotently: the same blockchain transfer can never be credited twice.
- Deposits are credited only after the network-specific number of confirmations and re-checked against the canonical chain; a reorganised transfer is reversed and reported with a payment.reversed webhook.
- Monthly fee statements and a full CSV account statement are available in every dashboard.
API and webhooks
- Public API reference, OpenAPI 3.1 specification and an llms.txt for AI assistants.
- Webhooks are signed with HMAC-SHA256 over a timestamp and the raw body (Stablora-Signature), retried with backoff, and can be inspected and replayed from the dashboard.
- Secret keys are scoped (read, payments, payouts), can be IP-restricted, and are split into live keys (qk_live_, real funds) and test keys (qk_test_, testnets only).
Account security
- Two-factor authentication (TOTP) with recovery codes, enforceable for whole teams.
- IP allowlists for the dashboard and API keys, team roles, session management and a security activity log with email alerts for sensitive changes.
- Payout approval rules: manual approval, automatic limits, daily caps and holds for new payout addresses.
Compliance
- Deposit senders and payout destinations are screened against the U.S. OFAC SDN list of digital-currency addresses (refreshed daily) and our own block list. Payouts to listed addresses are refused; deposits from them are frozen for review.
- We do not currently require identity documents to open an account. We may ask about a business or a transaction at any time and hold payouts until we hear back.
- Prohibited uses and our screening process are described in the AML policy.
Infrastructure
- Servers in the EU (Hetzner), behind Cloudflare, HTTPS only with HSTS and a strict content security policy.
- Automatic database backups, health monitoring and a public status page with component history.
- Hosted checkout pages load no third-party trackers; the only cookie is a sign-in session cookie.
Facts at a glance
| Operator | Stablora · [email protected] |
| Custody | Custodial, isolated signer, per-order deposit addresses |
| Networks | TRON, BNB Chain, Ethereum, Polygon, Arbitrum, Base, Optimism, Avalanche, Bitcoin, Litecoin, Solana, Dogecoin, Monero — plus public testnets |
| Fees | 0.5% per payment, +0.25% for auto-conversion, payouts 0.5% + network fee — pricing |
| Webhook signing | HMAC-SHA256 with timestamp — how to verify |
| Identity checks | No documents required today; information requests possible — AML policy |
| Documentation | API reference · OpenAPI · llms.txt · status |
Before you integrate
Stablora is a young service. Start with a test key on testnets, then send a small real payment and a small payout before routing real volume, and withdraw balances you do not need on the platform — automatic withdrawals can do that for you. Found a security issue? Write to [email protected] (see security.txt); we answer every report.