Private by proof,
not by promise.
What protects your users’ money on Senddy, from their device to the contract.
What protects funds
Four layers, from the user’s device to the contract.
Keys stay on the device
Spending keys are derived from the user’s wallet signature on their own device and never sent anywhere. A read-only view key can be shared with an auditor; it can’t move funds.
Proofs, not trust in us
Every send, swap and withdrawal is a zero-knowledge proof made on the device. Senddy never sees the amount, the balance or the counterparty.
Hardware-isolated verification
Proofs are checked inside a secure enclave with no shell and no persistent storage. Its signing key lives in a hardware security module that only the enclave can use.
Checks the contract enforces
Each note can be spent once, spends must cite a Merkle root the pool already knows, and deposits are screened against sanctions oracles before they’re accepted.
Reviews and transparency
The contracts and circuits go through internal security reviews, and findings are fixed before release. The pool contracts are source-verified on each chain’s explorer, so anyone can read exactly what runs.
Keeping an account safe
- Turn on every sign-in protectionPasskeys, biometrics or two-factor, wherever you can.
- Check before you sendConfirm the recipient. Private payments can’t be reversed.
- Ignore anyone asking for keysSenddy will never ask for your keys or a recovery phrase.
- Keep your device lockedUse device encryption and a strong passcode.
Report a vulnerability
If you find a security issue, tell us privately first. We’ll work with you to fix it and credit you if you’d like.