Service boundaries
- The website scanner reads public pages only and rejects local or private-network targets.
- The transaction pilot accepts unsigned intent only and never signs, broadcasts, or takes custody.
- Wallet-secret-like material is rejected before an intake is stored.
- Same-origin checks, bounded request bodies, rate controls, and baseline browser security headers protect public routes.
Member access
Member benefits require a signed-in account with a verified email. The service checks account ownership before returning linked purchases, receipts, available downloads, saved projects, or comparisons. Member prices are validated on the server; changing a displayed price does not change the amount accepted for fulfillment. Guest checkout remains separate and does not require an account.
Report handling
Saved report and paid-order tokens have high entropy and only a cryptographic hash is stored. Report responses are marked private and no-store, report pages are excluded from search indexing, and links expire automatically. Delivered transaction reports contain sanitized evidence; the unsigned request is retained only for the order's bounded fulfillment period.
Credentials and payment
Service, payment, and email credentials remain server-side and are not returned to the browser. We will never ask for a private key, seed phrase, recovery phrase, or keystore password. For website product orders, the server determines the price. Choose a payment method displayed for your selected product; each method has its own confirmation requirements, and payment evidence must match the order before delivery. This website does not collect card numbers.
Our separate wallet-payment API lists available currencies and networks for each selected offer. Check the exact quote and receipt flow before authorizing payment. Wallet signing stays with the wallet owner. API results require a private purchase capability and are retrieved through the API, not emailed. Never send a manual transfer in place of the API payment flow.
What the controls do not prove
Automated checks do not establish complete website security, accessibility conformance, legal compliance, smart-contract safety, or future chain behavior. Reports describe the evidence available at the time and identify limitations where evidence is unavailable.
Report a concern
Send a concise description and affected URL to info@gatewayinformationgroup.com. Do not include secrets, active exploit payloads, or personal data that is not necessary to understand the issue.