Security and compliance

Enterprise controls from day one, built into the platform.

Account and access

KYB verification

We verify your business before enabling live operations.

Scoped API keys, live and test

Each key carries fine-grained scopes, separate for live and test.

Multi-factor authentication

Dashboard access is protected with a second factor.

Role-based access

Control what each team member can see and do.

Withdrawal allow-list

Payouts only go to addresses you have pre-approved.

Cooling-off window

New destinations wait before they can receive funds.

Per-asset withdrawal limits

Cap how much can leave per transaction and per day, per asset.

Destination screening

Risky destinations are held for review before sending.

HMAC-signed webhooks

Every event is signed so you can verify it came from CowriePay.

Signing-secret rotation

Rotate secrets with an overlap window, with no missed deliveries.

Idempotency on writes

Safe retries, with no duplicate payouts.

Testnet and mainnet isolation

Sandbox and live data never mix.