1. Non-custodial by design
Trustless Commerce is wallet software, not a bank account. Your USDC, USDT, and other supported assets live on public blockchains at your wallet address. We cannot see your balance in a custodial ledger, freeze your funds, or send them on your behalf.
Control of the wallet belongs to the passkeys and security keys you authorize. Only someone who can unlock those keys on an enrolled device can sign transactions.
2. What we cannot do for you
Because we are non-custodial, we cannot:
- Reset your biometrics or device PIN.
- Recover a wallet if every authorized device is lost and recovery was not set up.
- Reverse a confirmed on-chain transaction.
- Move funds out of your wallet without your signature.
3. Protect your funds — use multiple devices
If this browser or phone is your only authorized device, losing or replacing it without pairing another device first can mean permanent loss of access.
Before you rely on a wallet for business funds, pair at least one additional trusted device from Wallet → Security → Devices. Passkey sync through iCloud or Google Password Manager alone is not sufficient; you must complete the in-app pairing flow so the wallet recognizes the new device.
4. WebAuthn and secure hardware
When you create a wallet, your browser creates a passkey in a platform authenticator — typically the secure hardware built into your phone or computer (Secure Enclave, TPM, or equivalent).
The private signing key never leaves that hardware. When you approve a transaction, the authenticator requires user verification: your fingerprint, face, or device PIN. Trustless Commerce receives only the cryptographic signature and public key coordinates needed to verify the action; we never receive biometric data or the private key.
5. Optional backup and recovery
You may add a YubiKey or compatible security key as an additional signing method. You may also configure email recovery with a guardian approval delay for simple wallets.
Legacy Super Wallet upgrades disable email recovery permanently. Identity Super Wallet is beta and unaudited; email recovery stays available. Plan recovery and device access before upgrading.
6. Avoid phishing
Use only the official Trustless Commerce origin you navigated to yourself. Do not enter wallet credentials on sites linked from unsolicited messages. We will never ask for a seed phrase — our wallets do not use seed phrases.
Read the passkey prompt carefully: verify the domain, transaction type, and recipient before approving.
7. Before you create a wallet
Confirm that you:
- Understand funds are on-chain and under your control, not ours.
- Have a plan to pair another device or configure recovery.
- Are on the genuine website and not an impersonation.
- Accept that lost devices without backup can mean lost access.
8. Contact
Report suspected phishing or security issues through our Telegram support channel at https://t.me/trustlesscommerce_support.