About
Safety, in plain words.
Selling digital goods for cryptocurrency means being paranoid on your behalf. Here is exactly what we protect, how we protect it, and the part that is yours.
HTTPS · Two confirmations · Hashed passwords
Paying safely
The rules are short because there is only one way to pay.
One address, always
Zenvia uses a single fixed Litecoin address for every order, shown on the payment card at checkout. It does not change between orders, baskets or sessions.
Only the one on our site
Never in a message
We will not send you a payment address by email, direct message or comment. If anyone does, they are not us - close it and come back to the site.
Phishing rule number one
Nothing but Litecoin
No card form, no bank details, no wallet connection that could sign on your behalf. You type the address into your own wallet and you press send yourself.
You keep the keys
Why two confirmations
The delay is the security feature.
It proves the payment is real
A broadcast transaction can still be replaced or reversed in its earliest moments. Two confirmations mean the transaction has been buried in the chain deeply enough that we are comfortable releasing goods against it.
It is the same reason refunds are traceable
Because we record the address a payment came from, a refund can be sent back to the only place it could have come from. Nobody else can claim your money in the meantime.
It costs a few minutes
Occasionally longer when the network is busy. Fifteen minutes is a normal worst case for an automated delivery - after that, open a ticket rather than paying again.
Your account
What we store, and what you should do with it.
Passwords are hashed
We store a salted hash, never the password itself. There is no readable copy of your password on our systems to leak.
Not readable, even by us
Sessions, not storage
Sign-in state lives in a session cookie. Nothing personal about you is written to your browser's local storage, and there are no tracking scripts.
Session cookie only
Verify your email
Delivery goes to the address on your account. Confirm it in Settings so nothing important ever lands in a mailbox you do not control.
Settings → verify
After you receive an account or subscription
Change the password immediately, sign out any sessions you do not recognise, and store the credentials somewhere that is not your inbox. We delivered the item; keeping it yours from there is the one step we cannot do for you.
What we will never ask for
If you are asked for any of these, it is not Zenvia.
Your password
Not to log in for you, not to debug something, not to confirm an order. Support can find your order with an order number and a payment address.
Never
A private key or seed phrase
We do not need, want, or have any way to use the keys to your wallet. Anyone asking for them is attempting to drain you.
Never
Payment to a new address
Our address does not change. A request to resend somewhere else - even from an account that looks like ours - is a scam.
Never
Remote access
We will never ask to control your device, screen-share your wallet, or install anything to help with an order.
Never
What we do on our side
The unglamorous part that never makes it into marketing.
Encrypted end to end
Every page is served over HTTPS, and database access is restricted to the services that need it with separate administrative credentials.
TLS everywhere
Logs with a short memory
Server logs are kept for roughly thirty days for security and error diagnosis, then discarded - unless an investigation needs them longer.
~30 days
Deliveries go only one way
Goods are sent to the address registered on your account, and credentials are never dispatched anywhere else - including to anyone claiming to be you.
Registered email only
Report something
Found a hole, or think someone is impersonating us?
Tell us first, quietly
Email support@sumox.net with the subject "Security". For a genuine vulnerability in the site, describe what you found and how to reproduce it, and give us a reasonable window to fix it before publishing - that gets you a faster fix and keeps customers safe in the meantime. For a phishing site or a fake account using our name, send the link and we will deal with it the same day.
Safe shopping is boring shopping.
One address, two confirmations, delivery to your inbox - nothing to watch out for except a phish pretending to be us.