Security

This page says exactly what protects you. Every item is something running in the code right now that you can test — not an adjective you have to take on trust.

The most important thing: the treasury key is not on this server

The treasury where customer funds are gathered lives on an offline hardware wallet. The Money Harbor server does not hold its key and cannot move money out of it — not even if it were fully breached.

The server can only send from a small hot float — we set its ceiling, and it is what pays withdrawals automatically, within minutes. Anything above the ceiling goes to the cold treasury. So the worst a breach of this server can take is bounded by that small float, not by the treasury. A withdrawal that hits a monitoring finding or passes the daily brake is still reviewed by a person and paid from the cold wallet, and takes some hours.

Your account

• Your password is not stored. Only a hash of it, with a standard algorithm. If our database leaked, there is no password in it to read.
• Changing your password signs you out of every device — immediately. This is not "wait for the session to expire"; every old cookie is invalidated at that instant. If someone is in your account, changing your password throws them out.
• Email two-factor authentication is available in settings. We recommend turning it on.
• Failed sign-in attempts are rate-limited. After a few failures, sign-in is closed for a while — and two-factor codes fall under the same limit, because a six-digit code with unlimited attempts is guessable.
• All traffic is encrypted with HTTPS and a valid certificate.

Your identity documents

• Stored outside the site's public folder and readable only through an authenticated check. Guessing the file's direct URL does not work.
• Images you upload are re-encoded so hidden data inside them is removed — including the GPS coordinates a phone camera writes into a photo. A picture of your ID taken at home carries your home address; we strip it.

Behind the scenes

• The ledger is auditable. Seven balance invariants run across the whole ledger to prove no money has been created or lost — and that check reads the stored data directly, rather than going through the same code it is meant to be checking.
• Backups are proven by restoring them, not by hoping. Every backup is restored into a scratch database and compared against the live one. A backup you have not restored is not a backup.
• Infrastructure is monitored around the clock and alerts if the site stops answering.

What is not security

Let us be plain: Money Harbor is not a bank, holds no banking licence, and no deposit-protection scheme covers your money. Technical protection is not a financial guarantee, and we do not have the second one.

Also, phone verification is not yet automated — the SMS code is not currently sent. If we listed that among our protections before, that was wrong.

Your part

• A strong and unique password — one you reuse elsewhere is only as safe as the weakest site you ever signed up to. Use a password manager.
• Turn on two-factor authentication.
• Read the withdrawal address twice. On-chain transactions are irreversible, and that is a human error no system can undo.
• We will never ask you for your password. Anyone who does is not us.

If you see anything security-related — even if you are unsure — write to info@moneyharbor.net. A false alarm beats silence.