Trust

Security and trust

What we keep, what we never touch, and what isn't built yet.

Onbehalf never holds your money or your wallet keys.

What we never touch

Your money: It moves from your own accounts, never through ours.
Private keys: No private keys or seed phrases, ever. The approver's wallet is a Coinbase embedded wallet. We only see its public addresses.
Biometrics: No face, fingerprint or other biometric. We don't even learn which one you used.
Cards and banks: No card numbers or bank logins. Stripe holds those.
Your agent's mind: No conversations. We see the request and the reason it gives. Never the agent's mind.

Only what the product needs:

People's names, work emails and roles. We use emails for sign-in.
Agents, and who owns them.
Your rules: limits, and who each agent can pay.
Recipients: names and wallet addresses.
Payments: amount, recipient, reason and time.
Outside ids: Stripe ids and chain transaction ids.
The public address of each connected wallet.
For passkeys, only the public half. The private half stays on your device or in your password manager.
Feedback you send us in the Console.
For Stripe, the access you give us when you connect your own Stripe test account. We use it only for what your rules allow. Today: test refunds, charges and account credits. Your money stays in your account.

An agent can ask. It can never approve, undo, resume or stop. No tool exists for it.

A yes covers one exact payment. Approving it needs the approver's passkey. On Base Sepolia, the approver's wallet signs the exact payment instead.

Loosening a limit, adding a recipient or inviting someone needs a fresh passkey too.

The stop button never waits for a passkey.

Stops and limit changes are signed records too. Anyone can check them on Verify.

Team members sign in with a one-time code sent to their work email.

We can look inside your Console only after your admin says yes. It is read only, lasts one hour, and every read is sealed.

The hosted Console signs receipts with one long-term key. This site publishes its public half, so anyone can check them.

Verify keeps nothing. It checks receipts in your browser. Nothing you drop in is uploaded or stored.

Receipts carry the approver's name. Never their email.

This website runs no analytics and no tracking.

The Console uses a session cookie and a security token, only to keep you signed in safely. No tracking cookies.

The full details are in our Privacy policy and Terms of service.

Encrypted backups are deleted after 30 days.

Planned for live customers:

Public timestamps. Planned.
Managed key storage for the signing key. The hosted test service signs with one permanent key today, kept in its secret store; a hardware-backed one is planned.
An outside security test (pen test), SOC 2 and managed key storage. Planned.
Emails for invites and for "a payment needs your yes". Next. Today, approvers see waiting payments in the Console.

Questions from your security team? Email hello@getonbehalf.com.

Questions? Email hello@getonbehalf.com. We reply within two working days.