Custody that assumes the worst day, every day
Custody is not a feature — it is the foundation everything else stands on. This page explains, in concrete terms, how customer assets are held, credited and released.
Watch-only by default, cold for anything that spends
Watch-only address derivation
Deposit addresses are derived from extended public keys. Internet-facing systems can generate addresses and observe funds — they hold no private keys and cannot spend, even if fully compromised.
Cold-first key storage
Spending keys live in cold storage, offline by default. The signing path is isolated from the web platform and requires explicit, logged, multi-party ceremonies.
Segregated, reconciled balances
Each customer's addresses and balances are individually tracked and continuously reconciled against the chain. The ledger must always be explainable back to on-chain reality.
Reorg-aware crediting
The crediting pipeline follows chain reorganisations. A deposit that leaves the best chain is re-verified before balances move — shallow reorgs cannot double-credit or strand funds.
From mempool to spendable — deliberately slow
A deposit is not money the moment it appears. It is a claim that the network can still take back through a chain reorganisation. Our ledger treats it that way:
- Detected — the transaction is seen; the balance shows as pending, nothing is spendable.
- Confirming — each new block deepens the transaction. Progress is visible the whole way.
- Credited — only after the required confirmation depth does the balance become spendable.
- Re-verified — if a reorganisation is detected, affected credits are re-checked against the new chain before anything else happens.
A transaction in one block can vanish if the network adopts a longer competing chain. Confirmation depth makes that exponentially unlikely. Platforms that credit instantly are taking that risk with your balance — we don't.
Many locks between a request and a signature
Request & policy checks
Destination allowlisting, velocity limits and anomaly checks run first. A request that fails any check stops here — fail-closed.
Multi-party approval
No single person or system can move customer funds. Withdrawals above thresholds require independent human approval.
Cold signing & broadcast
Only after approval does the signing path touch the transaction. The signed transaction is broadcast and tracked to confirmation.
What custody is not. MonetisePay is not a bank. Crypto-asset balances are not covered by government deposit-protection or investor-compensation schemes. Custody controls reduce operational and security risk — they cannot remove market risk, protocol risk or the consequences of a compromised account on your side. Read the full risk disclosure.