Security

Stored records are returned only by server-side code that verifies who you are first, and every record is scoped to the signed-in user. Traffic is encrypted in transit.

We do not claim any security certification, external audit, penetration test result or insurance. No system is perfectly secure.

Your sign-in is the door to your wallets. Treat it that way.

• Use an email account you control, with its own strong, unique password and two-factor authentication.
• Never share a one-time code with anyone, including someone claiming to be support. Nobody legitimate needs it.
• Sign out on shared or borrowed devices, and keep your browser and operating system updated.

Anyone who obtains your keys or recovery material controls your assets permanently. There is no reset and no recovery process that can undo it.

• Never type, paste, photograph or upload a recovery phrase or private key into any website, chat, form or support ticket.
• If you export wallet material, store it offline and treat it as the asset itself.
• Verify the address, network and amount on every transaction before signing — malware and clipboard hijackers modify addresses.
• Be extremely cautious with signature requests you did not initiate.

Fake sites, fake support accounts, fake airdrops and fake urgency are the most common way people lose crypto.

• Reach the interface by typing the address yourself or using your own bookmark, not by following a link from a message, advert or search result.
• Nobody from Roundtrip will ever direct-message you first, ask for a recovery phrase, ask you to move funds to a safe address, or offer to fix a position for you.
• Treat any message creating time pressure as hostile until you have verified it independently.

Move quickly: stop signing anything, disconnect the affected device, and move assets to a wallet whose keys have never touched the compromised device if you can do so safely.

Tell us through the Support page so we can look at any interface-side records. We cannot freeze, reverse or recover on-chain assets, and nobody else can either.

If you find a vulnerability in the interface, please report it privately through the channel described on the Support page before disclosing it publicly, and give us a reasonable chance to fix it.

Please do not access other users' data, degrade the service, run destructive or high-volume testing, or use social engineering against people. There is no formal bug bounty programme, and we will not invent a reward we cannot honour.