The safest custody is no custody.

Most payment providers ask you to trust their vault. We removed the vault. SureSettles is built so player funds never sit in an account we control — and the claims that matter here are verifiable on-chain, not in a compliance PDF.

Non-custodial by construction

• Deposit vaults without private keys. Stablecoin deposits land in smart-contract vault addresses. No private key for them exists — not on our servers, not anywhere — so funds can only move along the contract's settlement path.
• Settlement into your wallet. USDT settles into a wallet only you hold keys to. We never hold a balance for you — funds are in flight for minutes, never on deposit.
• Signing isolation. Keys that move funds live in an isolated settlement layer — never in the browser — and stored key material is encrypted at rest with AES-256-GCM.

Screened before it ever reaches you

• Multi-provider risk screening. Inbound senders are checked against sanctions lists and risk scoring from multiple independent providers before a deposit is credited.
• Worst result wins. Provider results aggregate pessimistically. High-risk senders are blocked; borderline cases go to manual review — never silently through.
• Fail-closed by default. If screening can't produce an answer, the deposit holds instead of crediting. No answer never means yes.
• Quarantine, not recycling. Funds tied to sanctioned sources are quarantined and never re-enter the settlement flow.

Signed, verified, replay-safe

• Signed webhooks. Every webhook is signed with HMAC-SHA256 using your API secret, carried in the X-Webhook-Signature header.
• Idempotent crediting. Deposit state transitions are atomic — retries, replays and race conditions can't double-credit a player.
• Player-token gating. The cashier widget only acts on player tokens signed by your backend.
• Hardened transport. TLS on every connection and hardened HTTP response headers across the stack.

Verifiable on-chain

Every hop of every settlement is a public on-chain transaction. Routing runs across battle-tested protocols audited by Halborn, Trail of Bits, PeckShield, SlowMist, Kudelski Security, OpenZeppelin, Zellic and Quarkslab, among others. We build on audited infrastructure and publish the path — trace any settlement yourself, any time.

Responsible disclosure

Found a weakness? Write to security@suresettles.com with a clear description and reproduction steps. We respond within two business days and work with researchers toward a coordinated disclosure.