Who holds your money
CoinPay is not one custody model, so we do not describe it with one word. Some parts of CoinPay never touch your funds. Some hold them for about a minute. Some hold them until someone tells us to let go. Below is which is which, what happens to your money if this company disappears, and who decides when two parties disagree.
1. Who holds the money right now
| Product | Who can move the funds | Custody |
|---|---|---|
| Web wallet | You, and only you. The seed is generated and encrypted in your browser and is never sent to our servers. | We never hold it |
| On-chain payments | You, after a short window. Customers pay to an address CoinPay derives, and our monitor forwards the balance to your wallet minus the fee. Between confirmation and forwarding, our infrastructure holds the key. | We hold it briefly |
| Escrow — default (custodial) | CoinPay, for the entire escrow. Funds sit at an address we derive from our own seed, and we move them when the depositor releases, a refund is requested, or an arbiter resolves a dispute. | We hold it |
| Escrow — 2-of-3 multisig | Not currently enabled. The 2-of-3 model is built and in the codebase, but it is switched off on this deployment, so you cannot create one today. Every escrow created right now is custodial. | Not available yet |
| Lightning wallet | CoinPay, until you withdraw. Lightning balances live on our node, not under your seed phrase. | We hold it |
Which of these apply to you.Escrow, Lightning, and the web wallet are opt-in — most merchants never enable them, and if you don't, the custodial rows above are not part of your setup. The payment forwarding window is not opt-in. It applies to every on-chain payment CoinPay processes, so it is the one row that describes you no matter how you use the product.
That window is worth being precise about, because “funds go directly to your wallet” is the kind of phrase that sounds like nothing touches them. Something does. Every payment is received at an address we derive from our own seed, and our monitor — which runs every minute — forwards the balance on to you minus the fee. There is no mode where a customer pays your wallet directly. In the normal case you are holding the funds well under a minute after confirmation. If a forward fails — a bad RPC, a gas shortfall — it retries, and the money stays at our address until it succeeds. During that time we could move it. We do not, but you are trusting us, not math.
Default escrow is the same trust, held for longer and on purpose. Money sits at our address for the length of the job. The 2-of-3 multisig model that would avoid this is built but not switched on here, so there is currently no way to create an escrow that CoinPay cannot unilaterally move. If that is not an acceptable trade, do not use escrow for that money. We would rather say that than let you assume an option exists.
2. What happens if CoinPay disappears tomorrow
Split by whether your funds depend on us being alive.
You are fine without us
- Web wallet. Your seed is in your browser and we never had it. Export it, import it into any compatible wallet, and your funds are unaffected by anything that happens to this company. Export it before you need it — clearing site data destroys the only copy we cannot help you replace.
- Money already forwarded. Once a payment reaches your wallet it is yours, in your custody, with no ongoing dependency on CoinPay.
The escape hatch is not currently open. 2-of-3 multisig escrow — where the depositor and beneficiary could settle without us — is implemented but switched off on this deployment. Until it is enabled, every escrow is custodial, and the answer to “what if you disappear” for escrowed funds is that you would be depending on us entirely. That is a real limitation and we are not going to bury it under a feature that is not turned on.
You are depending on us
- Default custodial escrow, funds mid-forward, and Lightning balancesare all held at addresses derived from CoinPay's own seed. If our infrastructure and our keys are gone, there is no third party holding a backup for you and no on-chain mechanism that releases the funds without us. Recovery would depend entirely on Profullstack, Inc. being able and willing to act.
- We are not a bank. There is no deposit insurance, no segregated trust account, and no regulator you can escalate to for these balances.
Open source helps, but not the way people assume. CoinPay is MIT-licensed and the full server is public, so you can audit exactly what we do with keys and you could run the whole stack yourself. What that does not do is give you our keys. Reading the code tells you the custodial escrow model is honest about what it is; it does not make it non-custodial. Treat the licence as a transparency guarantee, not a recovery plan.
The practical advice, which is against our interest to give and true anyway: keep working balances small, withdraw Lightning to on-chain for anything you would miss, and do not put anything into escrow that you could not absorb losing if this company stopped existing tomorrow.
3. When there is a dispute, who decides and on what evidence
Either the depositor or the beneficiary can open a dispute on a funded escrow. What happens next depends on who was named arbiter when the escrow was created.
- If you named an arbiter — a third party you both chose — that party decides, and CoinPay executes what they decide.
- If you did not name one, CoinPay decides. That is the default, it applies to most escrows, and it means the company operating the escrow is also refereeing it.
The evidence is whatever is attached to the escrow: the job description, milestones and deliverables written into its metadata at creation, the stated reason for the dispute, and the escrow's event log — every state change, timestamped, including the on-chain deposit and any settlement attempts. We can see when money arrived and what the two of you said the work was. We cannot see whether the work was actually good.
Two limits we would rather state than have you discover:
- There is no published response time and no formal evidence standard. A CoinPay-arbitrated dispute is a human reading the metadata and making a judgement call.
- There is no appeal.When CoinPay is the arbiter, CoinPay's decision is final and there is no external body to escalate to.
One thing does work in your favour. A funded escrow cannot sit forever: at expiry it settles automatically. By default it refunds the depositor; if the escrow was created with auto-release enabled, it pays the beneficiary instead. Either way the funds move without anyone needing us to intervene.
If a dispute is significant enough that “the company decides, with no appeal” is not an acceptable answer, name a mutually trusted arbiter at creation time — that is the only lever currently available, since the multisig model that would also stop the arbiter moving funds alone is not enabled here. Our default answer to this question is weaker than it should be, and we would rather you knew that before depositing than after.
Related: Terms of Service · Documentation · Source code
Found something on this page that does not match how CoinPay actually behaves? That is a bug we want reported — open an issue against the repository.