Fundsstaynon-custodial.

• Non-custodial by design. MettaPay never takes possession of user funds. All movement is wallet-signed and on-chain.
• Programmable escrow. Funds held in escrow are governed by audited smart contract templates with explicit release, refund, and dispute paths.
• Defense in depth. TLS in transit, encryption at rest, role-based access, audit logging, two-factor authentication, and least-privilege service accounts.
• Compliance. KYC/KYB, sanctions and address screening, transaction monitoring, and SAR-ready record keeping.

MettaPay is currently in internal review. A third-party smart contract audit is planned before mainnet escrow volume scales. We will publish the audit report and remediation summary on this page once complete. We do not and will not claim audits we have not received.

MettaPay connects via WalletConnect v2 and standard EVM wallet providers, including:

• MetaMask
• Coinbase Wallet
• Rainbow
• Trust Wallet
• Ledger & Trezor (via WalletConnect or MetaMask)

• Email: security@mettapays.com
• Response SLA: initial reply within 5 business days
• PGP key: available on request
• Machine-readable contact: /.well-known/security.txt
• See our Responsible Disclosure policy

In the event of a confirmed security incident affecting user funds or data, we will notify affected users within 72 hours of confirmation, publish a public post-mortem, and coordinate with regulators where required.

Researchers who responsibly disclose verified findings will be credited here, with permission.