Non-custody

Why JoPay cannot touch your money. Labs holds no user keys and no session keys — funds flow through immutable forward-only contracts.

In one line

Labs holds nothing. No user wallet key, no session key, no signing authority over merchant or payer funds. Payments flow from the payer's wallet through an immutable forward-only contract to the merchant's wallet. JoPay the app only observes and indexes.

Two things called "JoPay"

Internally, JoPay is split into two clearly separated pieces. Understanding the split is the key to understanding the non-custody claim.

When the pay page or this documentation says "JoPay" without qualification, it means Labs — the interface you interact with. The Protocol sits underneath and is unowned-by-anyone on-chain.

How a payment actually flows

A payment is a straight line from payer to merchant. The Protocol is the pipe; Labs is the label on the outside of the pipe.

1. Labs computes a unique postbox address for the request
   (deterministic via CREATE2 — same inputs → same address).

2. Pay page displays the amount + the postbox address.

3. Payer's wallet sends stablecoin to the postbox address.
   (Payer signs; their own wallet broadcasts the transaction.)

4. Anyone — typically a permissionless keeper bot — calls claim()
   on the postbox. The postbox contract atomically forwards
   balance − 0.01 USDC (keeper fee) to the merchant's wallet.

5. Labs observes the on-chain transfer and marks the request
   verified.

Labs signs nothing at steps 3, 4, or 5. The funds never pass through any Labs-controlled address.

What Labs holds (and what it doesn't)

Every key and credential the app touches, sorted by whether it could affect your money:

What happens in a worst-case compromise

If an attacker fully compromised Labs — Vercel account, KMS, database, email, everything — what could they do to merchant funds?

Nothing, without also compromising two other independent parties.

• Merchant funds sit in wallets keyed to the merchant's own signer. The attacker would need to compromise Sequence (for WaaS merchants) or the merchant's external wallet (for self-custody merchants) in addition.
• For Sequence WaaS merchants specifically: Sequence's MPC architecture splits the signing key between Sequence infra and the user's active session. The attacker would need to compromise Sequence and the user's live session.
• The Protocol contracts are immutable and have no admin. A Labs compromise cannot change their behaviour, pause them, or upgrade them.
• Pending payments at compromise time are already in transit from payer to postbox; the postbox is forward-only to the merchant. Attacker has no path to redirect them.

Three independent custodians (Labs + Sequence + user session) is better than the typical single-custodian model of traditional payment platforms.

Why this matters for the legal posture

The non-custody claim is the basis for JoPay operating as a software vendor rather than a payment service provider. It is why no EMI licence, no PSD2 licence, and no CASP registration are required for the Interface. Keeping it true at the architecture level — not just in marketing copy — is the company's most important engineering invariant.

If you spot a feature description or UI that implies JoPay holds, processes, or moves user funds, flag it — that framing drifts from product reality and has regulatory consequences.

What next?