Security
What protects your account, your money and your codes, written down so you can check it.
Your account
- Passwords stored with argon2We never keep your password, only a slow one-way hash of it that cannot be turned back into the password.
- Two-step sign-inTurn on an authenticator app under My account; after that a password alone does not open the account. Recovery codes are shown once.
- Sessions you controlEvery signed-in device is listed with its approximate place, and you can sign each one out. Sign-in cookies cannot be read by scripts and only travel over HTTPS.
- Limits on guessingRepeated wrong sign-ins slow down and then lock the account for a while, per account and per address.
Your money
- A ledger, not a balance fieldEvery top-up, purchase and refund is its own permanent entry; a balance is never edited in place.
- Payments checked before creditA crypto payment is credited only once its transaction is checked on the network for the exact amount; the same transaction can never be counted twice.
- Confirmed e-mail firstPayment reports, seller applications, sell-to-us requests and identity checks open only once your e-mail is confirmed.
Your codes and documents
- Codes only in your accountA delivered code is shown on your own order page, behind your sign-in; no other account can open it.
- Identity documents encryptedPhotos for identity checks are re-encoded with their location and camera data removed, stored encrypted, and every staff view is logged.
- Plain text everywhereNames, messages and listings are shown as text: code pasted into a form is refused or shown as harmless characters.
Behind the counter
- Every staff action recordedApprovals, refunds, price and stock changes are written to an audit log with who did it and when.
- Least access for staffStaff accounts have roles; each screen and action checks the role before it opens.
- Watching for abuseThrowaway e-mail addresses cannot open an account, and accounts that probe the site are closed.
What you can do
- Turn on two-step sign-in.
- Use a password you do not use anywhere else.
- We never ask for your password or a code in chat, e-mail or Telegram.
- Check the address bar: only our own domain.
Found a security problem? Write to support with the subject "Security"; reports are read by a person and answered. →