The vault is the only claim that matters.
We operate the vault — so we publish the count
Every major failure in this industry involved metal the seller controlled, and we are the seller. So our answer cannot be that somebody else holds it. It is that your metal is allocated to you, never lent, and subject to no lien of ours — and that what is in the vault is counted, attributed to the people who counted it, and published.
Allocated, never lent
It is yours from the moment it settles. We never lend it, lease it, pledge it as collateral, or pay a return on it. We hold no lien over it and no right to sell it out from under you.
We hold as little as possible
No card numbers, because there are no cards. No full bank account numbers — only the last four. No Social Security numbers, dates of birth, or ID images; our identity provider keeps those and we keep their verdict. What we never store cannot leak.
Counted by two people, and published either way
Our books are reconciled against the vault's count and the bank's own statement, and a count is not usable until a second named person has confirmed it — whoever took it cannot be the one who signs it off. We publish the result, the date it was taken, and who produced it. When that party is us rather than an outside auditor, the page says so instead of showing you a tick. When no count has been taken yet, it says that too.
None of the above is worth much on our say-so. The proof of reserves page publishes what customers own, what our books say is in the vault, what was actually counted, when, and by whom — including whether that party was independent of us. Today it is not, and the page says so rather than showing you a tick.
The specifics, so you can judge them.
“Bank-level security” means nothing and cannot be checked. These are the actual settings.
- Session cookie
- HttpOnly · Secure · SameSite
- Session token at rest
- SHA-256 hash
- Password hashing
- scrypt N=16384 r=8 p=1
- Minimum password
- 10 characters
- Wrong-password lockout
- 8 tries, then 15 minutes
- Per-network throttle
- 30 tries in 15 minutes
- Reset codes
- Hashed · single use · 1 hour
- Changing your password
- Signs out every session
- Third-party trackers
- None
JavaScript cannot read it, so an XSS bug cannot steal your session. src/auth/session.ts
We store a hash, not the token. A database copy does not let anyone sign in as you.
Deliberately slow and memory-hard, compared in constant time. Never reversible to your password.
Length only. No symbol or capital rules, because those reliably produce Password1!
Per account. Counted inside the same transaction as the attempt, so a failure cannot erase its own record.
Stops one machine working through many accounts at once.
Stored as a hash and spent on first use; asking for a new one voids the old.
Including the one you are using. If the old password leaked, leaving other sessions alive would defeat the point.
No analytics, no advertising pixel, no session recording. Fonts are served from our own origin so not even a font request tells anyone you were here.
Not here yet: two-factor authentication and passkeys. Both are planned and neither is built, so neither is listed above as though it were.
We debit your bank account by ACH to buy metal, and for no other reason. There is no balance to top up and no wallet holding your money between purchases — every debit is tied to the specific purchase it funds, and the authorization you sign says so in those words. It is the difference between a company that holds your metal and a company that holds your money, and we are only the first.