Origin-bound sessions
Cookies are host-only. Sibling apps cannot ride a Paypled session.
Security
Designed as if someone is already trying.
Paypled Shield is the default. Anti-phishing codes, hardware-backed 2FA, and a ledger that records who approved what — not a PDF of policies.
MPC custody
No complete key exists in one place. Policy engines authorize shares.
Withdrawal allow-lists
Lock destinations. Changes cool off for 24 hours.
Device binding
New browsers wait on a trusted device. Login alerts fire immediately.
SOC 2 Type II
Controls audited annually. Reports under NDA from compliance@paypled.com.
Bug bounty
security@paypled.com. We pay. We do not negotiate in public.