Security
This page covers how to report a vulnerability and how DNS://Money treats funds, data and compliance.
Report a vulnerability
Email support@dnsofmoney.com with "SECURITY" in the subject. Include the steps to reproduce the problem and the affected URL.
- We aim to reply within 1 to 2 business days.
- Please do not disclose the problem publicly until we have looked at it.
- Test only against your own account and your own data.
- Do not access other users' data, and do not degrade the service.
- We have no paid bug bounty today.
Our security.txt has the same contact.
Funds
- We never hold customer funds. Your wallet pays the recipient on-chain.
- We never hold your private keys.
- We are not a bank.
Compliance
- We screen every address written to the registry against the OFAC SDN list.
- A paid screen returns a verdict signed by
did:web:dnsofmoney.com. - We hold no SOC 2 report today. A SOC 2 report needs an independent audit.
- We hold no PCI DSS attestation today. We do not accept, store or send card numbers. MoonPay collects card data in its own widget when the on-ramp is on.
- ISO 20022: our payment models are compatible, not fully compliant.
- See our GENIUS Act posture.
Data and legal
Data
Read Data and subprocessors for data residency, subprocessors, data requests and the SBOM.