Double-spend happens.We catch it.
Bounded by limits, detected at settlement, recovered from the holder.
Non-custodial by design
PayVault never holds customer funds. Value is locked at your institution, and the allowance certificate only authorises spending it. If PayVault disappeared tomorrow, your customers' money would still be in your ledger.
Threatmodel summary
| Threat | Mitigation |
|---|---|
| Cloned device or extracted key | Non-extractable keys (hardware keystore and attestation planned for native SDKs), low caps, fork detection and revocation. |
| Replay to the same merchant | One-time request number and sequence checks. |
| Replay to a different merchant | Each payment is bound to a merchant ID. |
| Counter rollback on the device | The hash chain turns a rollback into a fork that reconciliation detects. |
| Fake payment made by a merchant | Not possible without the payer's private key. |
| Lost or stolen phone | PIN before signing. Remaining allowance is at risk like cash, is capped, and the key can be revoked. |
| Expired or revoked allowance | Checked offline against the last synced list. Risk within the sync window is accepted and bounded. |
| Coercion and scams | Low offline limits and merchant-bound payments. |
| Merchant data loss before sync | Durable encrypted queue. The payer keeps a copy and can also sync it. |
Cryptography choices
ECDSA P-256
Supported natively by iOS Secure Enclave and Android StrongBox, so keys stay in hardware.
SHA-256
Used for the hash chain that links each payment to the one before.
Fixed-layout binary encoding
Deterministic, compact payloads: a full payment bundle is 276 bytes and fits in a single QR code.
Platform cryptography
Signing and hashing use the platform's built-in WebCrypto, with no third-party crypto dependency.
Untrusted clocks
Ordering comes from sequence numbers. Expiry allows a skew window.
The merchant guarantee
A merchant who accepted a payment that passed every offline check gets paid. If a fork is later found, the key is revoked, the merchant is paid from the risk pool, and the loss is recovered from the KYC'd holder.
Where we are
PayVault is early. We have not completed an independent security audit, and we hold no certifications. We will publish results here when that changes.
Want the fullthreat model?
We share it with prospective partners under NDA.