Security and self-custody

Soca is built so that you never have to trust it with your money. Funds live in wallets whose keys you control, not in a Soca account balance. Every payment, subscription charge, and refund is a transaction on a public network that anyone can verify. This page explains what that means concretely.

What does non-custodial actually mean?

It means Soca is software around your money, never a holder of it. Soca is non-custodial: money settles to wallets you hold the keys for, and any wallet key can be exported at any time. In practice:

• Soca cannot move your money. Only a transaction you approve (or a subscription authorization you granted, within its limits) can move funds out of your wallet.
• Soca cannot freeze your money. There is no pooled balance to hold back and no withdrawal to delay. The money is already in your wallet.
• Soca cannot lose your money. Your balance is a record on the Solana network, not a row in Soca's database. If Soca went offline tomorrow, your funds would be exactly where they were.

One honest caveat about the asset itself: your dollars are USDC, issued by Circle. Like every regulated stablecoin, Circle can freeze USDC at a specific address under a valid legal order. That is a property of the dollar, not of Soca — Soca never holds that power over your wallet, and it is true wherever you hold USDC, not just on Soca.

Can I take my keys somewhere else?

Yes, and you can check this any time, which is the point. Every wallet in your Soca account, including wallets created automatically when you signed up with email or Google, has an exportable private key. The export is protected by your passkey, and the key can be imported into an independent wallet app such as Phantom. Self-custody with no exit is a slogan; the export button is the proof.

How is my account protected?

Signing in and approving sensitive actions is protected by passkeys: the phishing-resistant standard built into modern phones and laptops, where your device confirms it is really you (with Face ID, a fingerprint, or a device PIN) and there is no password to steal or reuse. Sensitive operations, like exporting a key, require a fresh passkey confirmation, and additional factors can be required on top of the initial sign-in.

What keeps subscriptions safe?

A Soca subscription is not a stored card a merchant can charge at will. It is an on-chain authorization with four hard limits, enforced by the network rather than by policy:

• Capped amount: a plan cannot charge above its approved limit for a billing period.
• Fixed destination: an existing authorization cannot be silently redirected to another wallet.
• One charge per period: on-chain accounting prevents duplicate renewals.
• Revocation is final: once a customer's revocation confirms, future unexecuted charges are blocked. No one can un-cancel a subscription.

What can Soca see, and what can it never do?

How are merchant integrations secured?

• Signed webhooks. Every event Soca delivers carries an x-wc-signature header: a timestamped HMAC-SHA256 signature you verify with your endpoint's signing secret, so forged or replayed events are rejected before they reach your fulfillment logic.
• Hashed API keys. Secret keys (sk_live_..., sk_test_...) are stored as hashes, shown once at creation, and revocable at any time in the dashboard. Test and live keys are strictly separated, and each key only reaches its own merchant's data.
• A settlement wallet that can't drift. The wallet a business settles to cannot be changed through the API. Changing it requires a fresh signature from the account owner, so a leaked key can read data but can never redirect money.