CentheadControls you can verify
What protects your account, your money and your data.
Accounts
Passwords are hashed with scrypt and checked against common choices. Authenticator-app two-step verification (TOTP) with single-use recovery codes protects sign-in and withdrawals. Sessions are HttpOnly, SameSite cookies with CSRF protection, and you can review and revoke each one.
Money
Every movement of value is a balanced double-entry transaction. The ledger is append-only, enforced by the database itself, and an integrity audit proves nothing was created or lost. Amounts are integer micro-dollars, never floating point.
Fraud resistance
Views are verified by the server’s own clock, a visibility measure and a presence check. Network payouts arrive only as signed, replay-protected, amount-capped messages. Rate limits, caps, multi-account and self-dealing signals flag accounts for review before money moves.
Payouts
Withdrawals go through Stripe Connect. Stripe performs identity verification and holds your bank and tax details. Centhead only stores a Stripe account reference.
Your data
We keep only what we need, never sell personal data, and hash IP addresses with a secret key rather than storing them. You can export or delete your data from Settings. Contact: privacy@example.com.
Embedded apps
The widget runs in Centhead’s own frame on strict Content-Security-Policy rules. Only origins an app registered can frame it, tokens are single-use and short-lived, and apps never see a viewer’s balance.
Report a vulnerability
If you believe you have found a security issue, email support@example.com. Please give us reasonable time to fix it before disclosing it. We will not take legal action against good-faith research.