Security
How Rampy is built, and what that protects.
The short version: we never hold your assets, so the worst thing that can happen to us is not the worst thing that can happen to you. Below is the longer version, including the parts we cannot help with.
Rampy holds no security certification and has not published an external audit. This page describes how the product is built rather than claiming a standard it has been measured against, and it will say so here when that changes.
Custody
The part that matters most, and the reason the rest is a smaller problem than it would otherwise be.
We do not hold your assets
Stablecoins are sent to a wallet address you control, and money is paid out to the bank account you choose. There is no Rampy balance to be drained, frozen or lost, because there is no Rampy balance.
Your keys are yours
Accounts signed in by email get a self-custodial wallet from our wallet provider. The key is assembled in a place we cannot read, and you can export it at any time and take it elsewhere.
Payouts go where you say, and nowhere quietly
Your own bank accounts must be in the name you are verified under. Paying somebody else takes their name and address, has a per-payment limit that starts lower while the account is new, and an auto-convert address cannot pay them until the account has been linked for a week. Adding a bank account or changing where payouts go needs a fresh code from your email, and we email you each time one happens.
Your account
How signing in works, and what you can turn on.
Sign-in codes are never stored
A code is six digits, valid for 10 minutes, and dead after 5 wrong guesses. What we store is a hash of it combined with a server secret, so a copy of our database does not let anyone sign in as you.
Sessions you can end
A session lasts up to 30 days, and ends after 7 days unused, in a cookie the browser will not hand to scripts and will not send across sites. We email you when a new device signs in, and Settings can sign out any device, or all of them at once, for when a laptop goes missing.
Two-step and a backup you hold
Your wallet can ask for a second step on every signature, and you can back it up by importing its recovery phrase into a wallet app of your choice, so losing your email or a device does not lose the wallet. Both are in Set up your wallet on the Wallet page — see the wallet guide.
Your orders
What stands between a mistake and a loss.
The price before the commitment
Every order shows the fee and an estimate of what you will receive before you confirm it. The fee is fixed when you place the order and changes only if you change the amount yourself. Where two currencies are involved — pounds into USDC, USDC into reais — the exchange rate is applied when our partner converts, so the amount that lands can differ slightly from the estimate; an exact payout fixes that amount instead. A deposit account or an auto-convert address has no quote: its fee is a percentage of what arrives, converted at the rate at that moment.
The address, read back to you
An order to a wallet asks you to confirm the address and the network, because that is the one mistake nobody can undo. Saved addresses are labelled so a familiar one can be picked rather than pasted.
Somewhere to go wrong
Orders that send crypto carry return instructions, so a transfer that cannot complete goes back to the wallet it came from rather than sitting in limbo waiting for a person.
Rate limits on real objects
Anything that creates a record at our payments partner — an order, a bank account, a deposit account — is capped per account per hour. A compromised session cannot spend the whole day creating them.
The platform
The plumbing, for anyone who wants to check it.
Strict content policy
The site declares where scripts may load from, refuses to be embedded in a frame, and blocks plugins and injected base tags. Connections are HTTPS-only, with the preload directive set.
Signed events
Updates from our payments partner are verified against their signing key before anything is written, and a signature older than a few minutes is refused, so a captured message cannot be replayed later.
Verified, not just believed
Order states are checked back against our partner on a schedule rather than only being accepted when we are told. A delivery that never arrives is found and corrected instead of leaving an order permanently wrong.
A record of operator actions
Anything a Rampy operator does to an account is written to an audit log with who did it and what changed. The log is append-only in normal use.
Your data
What we collect, and what we refuse to pass on.
Verification stays with the partner
Identity checks run in our regulated payments partner's own flow. Documents go to them, not to us, and we hold the outcome rather than the evidence.
Analytics only with consent
Nothing is measured until you allow it, and withdrawing consent clears what was set rather than merely stopping collection. See the cookie policy.
Nothing sensitive goes to advertisers
No name, email, amount, address or anything from a verification is sent to an advertising platform. Where a conversion is reported at all, it carries an advert click identifier and nothing else.
What this does not protect you from
Worth reading before it matters rather than afterwards.
Found something?
Report it to compliance@rampy.money with enough detail to reproduce it. We will confirm receipt and tell you what we find. Please give us a reasonable window to fix an issue before publishing it, and please do not test against other people’s accounts or data — a report is welcome, a breach is not.
We do not run a paid bounty programme, and saying so is fairer than leaving you to guess.