1. How we protect you
Engineering to confirm each control below is live before publishing.
- Passkeys and device binding to sign in and approve transfers.
- Encryption of data in transit and at rest.
- Fraud and sanctions screening on every transfer.
- Least-privilege access for staff, with logging and regular review.
- Oversight of service providers as required by the FTC Safeguards Rule.
- An incident response plan, including notification of customers and regulators when the law requires.
2. Reporting a vulnerability
Email security@speedymoneytransfer.com with a description of the issue, steps to reproduce it and its potential impact. Encrypt sensitive details using the key listed in our security.txt file at legal.speedymoneytransfer.com/.well-known/security.txt.
We will acknowledge your report within 3 business days, keep you informed, and credit you if you wish once the issue is fixed.
3. Rules for research
- Test only against accounts you own, and stop if you access anyone else's data.
- Do not move real money, degrade our services, use social engineering or physical attacks, or access more data than needed to show the issue.
- Give us reasonable time to fix the issue before disclosing it.
4. Our promise
If you follow these rules in good faith, we will not pursue legal action against you for your research and will consider it authorized under applicable anti-hacking laws.
5. Out of scope
Reports about missing best-practice headers without a demonstrated impact, denial-of-service testing, spam, rate-limit findings without a security impact, and issues in third-party services we don't control.