veil

For AI Agents

x402-ready identities for autonomous payments

For Teams

Crypto payroll to any bank globally

For Everyone

Send and receive anywhere, stay private

DocsPricingSecurityBlogAbout
Get started

Secure by architecture.

Even a compromised API key can’t steal your funds. Here’s why.

One direction. No reverse path.

One-way by design

Veil is a one-way offramp. Funds flow in one direction: from your crypto wallet, through a licensed conversion partner, to your bank account. There is no reverse path.

There is no function in the API to send funds to an external wallet. There is no way to redirect a payout to a third party. There is no endpoint to change the destination mid-transaction. The only place money can go is the bank account you verified during onboarding.

If someone gains access to your API key, the worst outcome is that an offramp is triggered early - to your own bank account. Your money still arrives at your bank. Not theirs.

What an attacker cannot do

Redirect funds to a different bank account - payout destination is locked to your KYC identity
Send crypto to an external wallet - the API has no outbound transfer function
Change your bank account without 2FA - requires authenticator code and triggers a 48-hour hold
Bypass identity verification - every account is verified through a licensed KYC provider
Access the dashboard with just an API key - dashboard requires email + 2FA separately
Exceed your configured limits - per-wallet daily limits are enforced server-side

What an attacker can do

With a compromised API key.

With a stolen API key, an attacker can trigger offramps - but only to your own verified bank account, within your configured limits. They can also read wallet balances and transaction history.

This is the blast radius. It’s limited by design.

To limit exposure further: rotate your API key immediately from the dashboard, enable IP allowlisting for production keys, and set conservative per-wallet daily limits.

How your account is protected

Ten layers. Defense in depth.

01Secure credential storageThe Veil CLI stores your API key in your operating system’s keychain - macOS Keychain, Windows Credential Manager, or Linux Secret Service. Encrypted at rest, protected by your OS login. Never stored in plain text.
02Identity verificationEvery account is verified through a licensed third-party KYC provider before any live offramp is allowed. Your payout bank account must match your verified identity.
03Two-factor authenticationAuthenticator app (TOTP) is required before enabling live mode. Also required for: changing your bank account, modifying auto-offramp rules, creating or revoking API keys, and unfreezing your account.
04Locked payout destinationYour bank account is set during onboarding and locked to your KYC identity. Changing it requires 2FA re-authentication and a 48-hour cooling-off period. You receive an email notification immediately when a change is requested.
05Per-wallet limitsConfigure daily offramp limits on each wallet. Auto-offramp rules respect these limits. Even with full API access, transactions exceeding your limits are rejected. Increasing limits requires 2FA.
06API key controlsCreate scoped keys: read-only for monitoring, full-access for operations. Rotate or revoke keys instantly from the dashboard. Optionally restrict keys to specific IP addresses.
07Email notificationsEvery offramp triggers an email notification - manual or automated. Bank account change requests, API key creation, rule changes, and login from new devices all trigger immediate alerts.
08Account freezeInstantly freeze all offramp activity with one click or one CLI command. No 2FA required to freeze - speed matters in an emergency. 2FA is required to unfreeze.
09Ephemeral deposit addressesEach deposit uses a unique address generated for that transaction. Addresses are not reused. There are no persistent balances sitting in a targetable wallet.
10No custodyVeil never holds, stores, or has access to your crypto or fiat at any point. Funds are received and converted by a licensed payment partner. We orchestrate the flow - we never touch the money.

Security for automated offramps

Manual offramps

Triggered from dashboard or CLI

2FA required for each transaction

Human is present to authenticate

Automated offramps

Triggered by rules you configure

2FA required when creating the rule

Executes hands-free within your limits

This is the same model as standing orders in traditional banking - you authenticate once to set up the instruction, then it executes automatically.

If something goes wrong

If you suspect unauthorized access:

01Freeze your account immediately - dashboard or veil account freeze from any terminal
02Revoke all API keys from the dashboard
03Contact security@veil.com

Freezing is instant and does not require 2FA. All pending offramps are paused. No funds leave your account while frozen.

Questions about security?

Reach us at security@veil.com

Get started →