Security & privacy
A security product has to hold itself to a higher standard. Here is exactly what we see, what we store, and how to report a vulnerability.
We never touch your keys
CryptGuard never asks for, receives or stores private keys or recovery phrases. Revoking an approval creates a standard transaction that you review and sign in your own wallet.
What runs where
- The Signature Inspector and Scam Checker analyze your input in your browser.
- Wallet scans and simulations send only public addresses and unsigned transactions to public blockchain nodes through our server.
- Unknown function selectors (4 bytes) are looked up in a public signature database. Domain names from messages are looked up in public RDAP registries.
What we store
- Accounts: email, a salted scrypt password hash, plan.
- Watchlists, alerts and alert-channel settings you create.
- Co-Signer API keys are stored only as SHA-256 hashes. Evaluations are kept as your audit log.
We do not sell data and we do not use third-party trackers. The site runs under a strict Content-Security-Policy that allows no third-party scripts.
Co-Signer integrity
Every Co-Signer decision is signed with Ed25519, bound to the SHA-256 of the exact request, and expires after five minutes. The public key is published at /api/v1/attestation-key.
Responsible disclosure
Found a vulnerability? Email security@cryptguard.app. We respond within one business day and do not pursue good-faith researchers.