What Payclose can and can’t do with your money

Hold your funds

No. They stay in your Safe or wallet until a transaction your team signs moves them.

Sign a transaction

No. Payclose has no key that can sign a transfer. A Safe owner signs in their own wallet; a regular wallet signs its own transfers.

Approve a payout

No. An approval is a passkey signature made on the approver’s device. Payclose keeps only public keys: it can check an approval, not make one.

Change what was approved

No. An approval covers the exact lines that were sent. Any change makes a new version, and earlier approvals don’t carry over.

Ask for a token allowance

No. No token approvals and no third-party batch contract: every transfer goes from your wallet straight to the recipient.

Prepare and check the payout

Yes. That’s the job: compare it with last month, check the addresses, collect approvals, build the batch, check the result on-chain.

• Approvers sign the payout with a passkey on their own device, over the hash of the exact lines sent. Whoever sent it can’t approve it. The fingerprint, the first 8 characters of that hash, is in the approval email, on the payout page and next to the proposal in Safe{Wallet}: if they don’t match, don’t approve and don’t sign.
• Your wallet signs the transaction. From a Safe, one owner signs the batch, and Payclose’s server passes the signature on to Safe only if it matches the batch rebuilt from the approved version; the owners execute it in Safe{Wallet}. A regular wallet signs and sends its own transfers.
• Recipients sign a message, not a transaction, to confirm their address in the recipient portal. It proves they control the wallet and moves no funds.

A stablecoin transfer can’t be reversed, so a new payout address goes through four steps before anyone is paid to it:

• It comes from your team or from the recipient. In the recipient portal, the recipient confirms it with a signature from that wallet; a change is signed by the new wallet and the current one.
• It’s checked for checksum errors, for look-alikes of every address on file and in past payouts, and for an address another recipient already has.
• Someone else approves it: an owner or approver who didn’t propose it (alone in an organization, you approve your own). Owners can require the recipient’s confirmation first.
• It waits 24 hours after approval before a payout can use it.

A payout whose address was revoked or replaced after sending can’t be approved or paid until it’s sent again. Why this matters: address poisoning and company payouts.

Every approved payout has a proof file: the approved lines, each approver’s passkey signature and, once paid, the transactions. Your auditor or accountant can check it at payclose.app/verify without an account and without trusting Payclose: the page recomputes the fingerprint, checks every signature with the browser’s own cryptography, counts the approvers against your rule and checks that every line was paid. The file never leaves the browser. What it can’t show is who holds a passkey: the name next to each approval is Payclose’s record.

Payclose reads each transaction’s receipt and compares its transfers with the approved lines: from the payout’s wallet, in the right token, to the approved address, for the exact amount, once the block is final enough on its network. A line not paid as approved, or a transfer no line expected, is flagged, and the owners get an email. See reconciliation.

• Stored: accounts and roles, passkeys’ public keys, recipients with their payout addresses, payouts with their approvals and transaction hashes, your wallets’ public addresses, the activity log.
• Never stored: private keys, seed phrases, the private part of a passkey, passwords (there are none).
• Logs hold ids, transaction hashes and error types, never email addresses, wallet addresses or amounts. Entries in the activity log can’t be edited or deleted.
• No trackers in the app. run.payclose.app has no advertising or analytics tags, and this website’s analytics never receive an email address, a company name or anything you put into the free tools.

Cloudflare hosts the app and its database; Safe proposals go to Safe’s Transaction Service. Every provider and how long data is kept: the privacy notice.

There are no passwords. A sign-in link works once, for 15 minutes, and links and sessions are stored only as one-way hashes. Adding or removing a passkey needs a recent sign-in or a passkey you already have, and Payclose emails you when it happens.

Payclose’s servers can’t move money. A compromised server could still try to put a wrong payout in front of you, so the checks that matter don’t depend on trusting it: the approval email lists every changed address in full with the fingerprint, approvers sign the exact lines on their own devices, your wallet shows the transaction before you sign it, and the payout is checked against the chain afterwards.

Found a security problem in the app at run.payclose.app or on this website? Email hello@payclose.app with “Security” in the subject, and include what you found and where (a page, an API path or a file), the steps to reproduce it, what someone could do with it, and how to reach you.

Test only with your own account and organization, don’t access or change anyone else’s data, and don’t run denial of service, spam or social engineering. Give us reasonable time to fix the problem before you publish it.

We’ll acknowledge your report, keep you updated and tell you when it’s fixed. There is no paid bug bounty. The same contact is in our security.txt.