How security works. What each control covers.

SureSettles does not maintain merchant balances. Funds may be in transit while a route completes; cleared deposits settle as USDT to the merchant-configured wallet. Controls differ by route, so the claims below describe specific flows rather than every asset or route.

Controls vary by route

• Stablecoin contract-vault flows. Supported stablecoin deposits can land in smart-contract vault addresses that do not use private keys. Other assets use single-use addresses with keys and are swept through the settlement path.
• Settlement to the configured wallet. Cleared deposits settle as USDT on TRON (TRC-20) to the merchant-controlled wallet. Funds may be in transit while a route completes; SureSettles does not maintain a merchant balance.
• Signing isolation. Keys that move funds live in an isolated settlement layer, not in the browser or merchant integration. Stored key material is encrypted at rest with AES-256-GCM.

Deposit screening policy

• Route-specific screening. Supported routes assess available sender information using configured providers where data permits.
• What blocks credit. Under the current policy, positive sanctions matches or high-risk results block credit. Review-band results, provider outages, or unresolved or incomplete sender data may proceed with an operational warning and do not automatically create a hold.
• Case handling. Confirmed blocking matches may enter the applicable quarantine or case process. Next steps depend on the finding, route, merchant configuration, and applicable law.

Signed, verified, replay-safe

• Signed webhooks. Every webhook is signed with HMAC-SHA256 using your API secret, carried in the X-Webhook-Signature header.
• Idempotent crediting. Deposit state transitions are atomic — retries, replays and race conditions can't double-credit a player.
• Player-token gating. The cashier widget only acts on player tokens signed by your backend.
• Hardened transport. TLS on every connection and hardened HTTP response headers across the stack.

Verifiable on-chain

On-chain transfers can be verified on their public networks; off-chain provider processing is not itself visible on-chain. Some underlying protocols and components used by certain routes have published third-party audit reports. Those reports cover their stated scope, not SureSettles or the complete SureSettles system.

Responsible disclosure

Found a weakness? Contact us at sales@suresettles.com with a clear description and reproduction steps. Do not include passwords, API keys or private keys.