dolaramp

security.

dolaramp is software, not a custodian. the short version: your keys stay with you, we only read official token contracts, and every update the app installs is signed.

1. keys are born on your phone. the private keys and the 12 words are generated on the device and kept in its secure hardware (secure enclave / keystore). they never reach our servers.
2. we cannot move your money. no one at dolaramp can freeze, move or recover your funds. whoever holds the 12 words holds the wallet, in dolaramp or in any standard wallet (see support).
3. you sign every send. the transaction is signed on your phone; we only add the gas sponsorship and our fee, which you see before you confirm.
4. no fake tokens. the app reads only the issuers' official contracts, so a lookalike token cannot show up in your balance. the list is public on contracts, and the address checker lets anyone look.
5. locked by default. PIN (stored hashed, on your device) plus face id / fingerprint handled by your phone's system.
6. signed updates. over-the-air updates are cryptographically signed; the app does not run code that was not signed by us.

1. your keys, your envelope. hotwallet keys are sealed with your wallet_secret, shown once at creation. deleting a hotwallet needs it too, or a one-time reset code.
2. signed webhooks. every event carries a signature you verify with your webhook secret, so a forged call cannot mark an order as paid.
3. no surprise payouts. a withdrawal larger than the balance is refused. idempotency keys stop the same operation from running twice.
4. quote before you move. fees are shown by the quote endpoints before any operation, and every operation is itemized in the ledger.

we keep the minimum to run the service: an email to sign you in and your public addresses to show balances. no documents, no ad trackers, no third-party analytics. the full list is in the privacy policy.

write to hello@dolaramp.com with "security" in the subject. tell us what you found and how to reproduce it; please don't test against other people's wallets or accounts. we answer every report. machine-readable contact: security.txt.

blockchain transactions are irreversible. always check the address before you send.