No. Vaulty is a non-custodial Solana wallet. Private keys never leave your device unencrypted and Vaulty cannot move funds without your biometric or PIN approval.

How do I report a security issue?

Email security@vaulty.world with a description and reproduction steps. We acknowledge reports within 48 hours.

Where is my backup stored?

Encrypted backups can be pinned to Arweave (permanent) or Pinata/IPFS. Only ciphertext is uploaded; decryption requires your local secret.

Trust · Transparency · Security

How Vaulty Protects You

Vaulty is a non-custodial Solana wallet and yield engine. Every claim below maps to public, on-chain or open-source behavior — no trust-us promises.

Anti-phishing promise

Vaulty will never:

DM you on Telegram, Discord or email asking you to "verify" your wallet.
Ask for your seed phrase, recovery words or private key.
Run Google sign-in from anywhere other than accounts.google.com.
Ask you to "import" or "re-authenticate" your wallet via a link.

The only domain that owns your passkey is vaulty.world. Report anything else to security@vaulty.world.

Non-Custodial Keys

Private keys are generated and stored on your device. Vaulty servers never see them. Signing always requires biometric or PIN confirmation on the original device.

Biometric & PIN Gating

Every value-moving action — send, swap, payout claim — requires a fresh local unlock. Sessions auto-lock and Jarvis defaults to read-only.

Arweave Permanent Backup

Encrypted backups can be pinned to Arweave or IPFS. Only ciphertext leaves the device. Read the protocol.

Read-Only AI Assistant

Jarvis can read balances and explain features but cannot sign on your behalf. Build/execute transactions still require explicit biometric approval.

On-Chain Auditability

Treasury, payouts, and competition draws are recorded on Solana. Verify any time on Solscan.

Modern TLS & Headers

TLS 1.3 with modern ciphers, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and a Report-Only CSP across every page.

Responsible Disclosure

Found a vulnerability? Please email security@vaulty.world with reproduction steps. We acknowledge reports within 48 hours and credit researchers in our security log unless you ask us not to. Do not post live PoCs publicly until we've confirmed a fix.

Phishing & Brand Safety

The only official Vaulty domain is vaulty.world. We will never DM you for your seed phrase, PIN, or biometric data. If a page asks for those things outside the unlock flow on this domain, it's not us — please tell us.

Contact

hello@vaulty.world — general & support
security@vaulty.world — responsible disclosure
legal@vaulty.world — legal & compliance