Security
Your card details go straight to our regulated partner, your tokens go straight to your wallet, and your keys stay with you. Most of the security here is in what the system declines to hold.
Your card reaches the partner, and only them
Card details are entered in our payment partner's own window and go directly to them. MultiNFT never receives, stores or transmits a card number, expiry date or security code — this application has no path that could, because one is never handed to it. Our partner is the merchant of record for the card and carries its own PCI compliance.
Your tokens and your keys
The token is minted directly to the wallet address you supply. We take no custody of a token once it is sold, and we never ask for a private key or a seed phrase — nobody at MultiNFT has any reason to. A message asking for either is not from us; see Legal & company for how to recognise a genuine one.
The payment notification is authenticated
An unauthenticated payment webhook is a free-money endpoint, so ours refuses to operate without a secret. Every incoming notification is verified by HMAC-SHA256 over the raw request body with a constant-time comparison, and when no signing secret is configured the endpoint refuses the request rather than accepting it — it fails closed, not open. A replay creates no second obligation, and a late success on an order previously marked failed still lands, because the card cleared and the buyer is owed the token.
What you can read before you buy
The minting contract's source will be published and verified on the block explorer at launch, so you can read exactly what it does before buying rather than taking our word for it. It is covered by a test suite including a 256-case property test asserting the recipient always receives the token, and a check that the fee destination can never be set to an address that would burn the settlement.
The site is served over HTTPS only, on a certificate that renews automatically. There are no third-party scripts, no advertising or analytics trackers, and no external stylesheets or fonts: the typefaces and the payment SDK are served from this domain, so no host we do not control sits in the payment path.
Reporting something
If you find a security issue, write to legal@multinft.app with enough detail to reproduce it. We acknowledge within 1 business day, we take no action against you for reporting in good faith, and we tell you what we did about it.