Security and data

Payclose is workflow software. It never holds funds or keys and is not a wallet or exchange. It prepares, checks and records payouts; your team signs them, from your own wallets.

This guide has the details. The short version, with how to report a vulnerability, is on the security page: what Payclose can and can’t do with your money.

Non-custodial by design

• Your funds stay where they are. Payclose has no key that can sign a transfer. A Safe owner signs the batch in their own wallet; a regular wallet signs and sends its own transactions.
• You see what you sign. Payclose builds the Safe transaction, or each transfer, from the approved lines only, and your wallet shows it before you confirm.
• Signatures are checked, not made. For a Safe, Payclose’s server rebuilds the batch from the approved version and forwards your signature only if it matches. Any change to the transaction would make the signature invalid.
• No allowances. Payclose never asks for a token approval and uses no third-party batch contract: every transfer goes from your Safe or wallet straight to the recipient.

Approvals you can check

• A payout approval is a passkey signature of the hash of the exact lines that were sent, made on the approver’s device. Payclose stores only the public key, so it can check approvals but can’t make one.
• The fingerprint, the first 8 characters of that hash, is in the approval email, on the payout page and with the proposal in the Safe{Wallet} queue. If they don’t match, don’t approve and don’t sign.
• Any change after sending creates a new version, and the earlier approvals don’t carry over.
• A new payout address is checked for look-alikes and checksum errors, approved by someone other than the person who proposed it, and held for 24 hours before it can be paid.

Check a payout proof

Every approved payout has a proof: a file with the exact lines that were approved, each approver’s passkey signature of those lines and, once the payout is paid, the transactions that paid them. Download it with Download proof on the payout’s Approvals tab; once the payout is reconciled, Next step offers it too.

Anyone you share it with, an auditor or an accountant, can check it at payclose.app/verify without an account and without trusting Payclose. The page recomputes the fingerprint from the lines, checks every signature with the browser’s own cryptography, counts the different people who approved against your approval rule, and checks that every line was paid, with a link to each transaction on the block explorer. The file is checked in the browser and never uploaded.

The proof can’t show who holds a passkey: the name next to each approval is Payclose’s record. An approval stays checkable only while its passkey is in the approver’s account, so a passkey removed after approving leaves that approval without the key to check it against.

Sign-in

• There are no passwords. A sign-in link works once, for 15 minutes, and Payclose stores sign-in links and sessions only as one-way hashes.
• The sign-in page runs a Cloudflare Turnstile check, and requests are limited per email address, per network and per minute.
• One cookie keeps you signed in for up to 30 days.
• Adding or removing a passkey needs a recent sign-in or a confirmation with a passkey you already have, and Payclose emails you when it happens.
• The app has its own address, run.payclose.app, with a strict Content Security Policy and no advertising or analytics trackers. The Google tags of this website run only here, on payclose.app.

What the app stores

• Your account: your email address, your name if you add one, your organizations and your role in each.
• Passkeys: their public keys only.
• Recipients: names, email addresses if you add them, usual amounts, and payout addresses with who proposed and approved each one.
• Payouts: the lines, the versions sent for approval, the approvals with their passkey signatures, and the transactions: their hashes, the wallet address that proposed or paid them, and how each transfer matched on-chain.
• Company wallets: public addresses only, never keys or seed phrases.
• The activity log, and the feedback you send from the app.

Cloudflare hosts the app and its database and sends its emails. For a Safe payout, the proposal goes to the Safe Transaction Service run by Safe, where anyone who knows the Safe’s address can see its queue. Payclose reads public chain data through blockchain node (RPC) providers.

The full list, the reasons, the providers and how long each thing is kept are in the privacy notice. To have your organization’s data deleted, write to hello@payclose.app.

Logs without personal data

• Payclose’s server logs hold ids, transaction hashes and error types, never email addresses, wallet addresses or amounts.
• The Activity log, for owners, records every change, who made it and when, and refers to people, recipients and addresses by internal ids. Its entries can’t be edited or deleted.
• The technical details attached to feedback carry request paths and error codes, never what you typed or what the page showed.