Security
How PayNovaX secures your account and cards
Funding a card with crypto means trusting a platform with money, so this page sets out plainly how sign-in is protected, what control you keep over a card, and how the card program is structured behind the scenes.
Where something is handled by a partner rather than by PayNovaX, it says so. Knowing which company is responsible for what is more useful than a page of security badges.
Account security
Getting into your account
Most losses in crypto start with account access rather than anything exotic, so this is where the meaningful protection sits.
One-time codes on sign-in and sensitive actions
Registration is confirmed with a code sent to your email, and sign-ins or sensitive actions can require a further one-time code. A leaked password on its own is not enough to reach your balance.
Authenticator app as well as email
Codes can come from an authenticator app rather than your inbox. That is the stronger option, because it keeps account access from depending on the security of your email provider.
Sessions the browser will not hand over
Session cookies are httpOnly and served over HTTPS in production, so page scripts cannot read them. Sessions expire after 24 hours and signing out clears them immediately.
Biometric unlock on mobile
In the mobile app, unlocking with Face ID or a fingerprint exchanges a token held in your device's secure enclave for a fresh session. The credential stays on the device.
If you turn on only one thing, make it authenticator-app codes rather than email.
Card controls
What you can do if something looks wrong
Prevention matters less than how quickly you can contain a problem. These controls are in your account and take effect immediately.
Freeze instantly, keep the balance
Freezing stops spending straight away and leaves the balance alone. If a card number turns up somewhere it should not, freezing first and working out what happened afterwards costs you nothing.
Take the money back off
Card balances move in both directions. You can unload a card back to your account, so limiting your exposure never means abandoning funds on a card you no longer trust.
Virtual by default
There is no physical card to be lost in the post, skimmed at a terminal, or taken from a wallet. Card details live in your account behind the same sign-in protections as everything else.
Spend visible as it clears
Transactions appear against the card as they settle rather than at the end of a statement period, which is what makes an unexpected charge something you notice in hours instead of weeks.
Keeping a card's balance close to what you are about to spend, and topping it up when you need it, limits what any single compromised card can cost you.
How the program is structured
Who is responsible for what
A crypto-funded card involves more than one company, and it is worth knowing which one does what before you put money on a card.
- PayNovaX
- The platform you sign in to. We handle your account, your wallet balances, deposits and the interface you use to open, fund, freeze and unload cards.
- The card program partner
- Operates the card program itself and connects it to the issuing institution. Card issuance, authorisation and currency conversion happen here rather than at PayNovaX.
- The issuing institution
- A licensed financial institution that issues the cards under its own regulatory permissions and its agreement with the card network.
Where your funds sit
PayNovaX is not a self-custody wallet. Crypto you deposit is credited to a balance inside your account rather than to a wallet whose keys you hold, which is precisely why the account protections above matter. You can move that balance onto a card or take it back off at any time.
Deposits are also irreversible in the way all crypto transfers are. Sending a token over a network the deposit address does not support is the most common way people lose money here, and the supported tokens page sets out exactly which pairings work.
Identity verification
Getting started needs an email address and a one-time code, so you are not waiting on a manual review before you can look around. Identity verification applies when a card program requires it, and the documents you provide are used to satisfy the issuer's checks rather than kept for any other purpose.
What we collect and who we share it with is set out in the privacy policy.
If something goes wrong
What to do first
Contain it before you investigate it. The first two steps take seconds and are reversible, so there is no cost to doing them while you are still unsure.
- 1Freeze the affected card from your account. This is instant and does not touch the balance.
- 2Unload the card balance back to your account so nothing further can be spent from it.
- 3Change your password, and switch one-time codes to an authenticator app if you are still receiving them by email.
- 4Email support with the card and the transactions you do not recognise.
Reporting a security issue
If you have found a vulnerability in PayNovaX, or you believe an account has been accessed by someone else, tell us at support@paynovax.io.
Include enough detail to reproduce the issue. Please report it to us before disclosing it publicly, and do not test against accounts or cards that are not your own.
Security FAQ
Questions about security
Ready when you are
Start spending crypto like cash
Create your PayNovaX account, fund a card, and make your first purchase.
Create account