Trust
What we say, and how you can check it.
Every claim on this website links here. This page says what each one rests on, and says plainly where something is not live yet.
The ledger
-
Double-entry
Every purchase, redemption, refund and pay-out is recorded as matching lines on both sides, so the books always balance.
-
Only ever added to
Lines are added and never changed or deleted. A mistake is put right with a new line that reverses it, so the history stays whole.
-
Hash-chained
Each line carries a fingerprint (a SHA-256 hash) that includes the line before it, so changing any earlier line would break every fingerprint after it.
-
A checkpoint every day
Every day the ledger takes a checkpoint: the fingerprint of its newest line, and a commitment made from the checkpoint's number, its date and that fingerprint.
The public checkpoint verifier
The platform's public checkpoint page lists the newest checkpoints. For each one it shows the fingerprint, the commitment and the exact bytes the commitment is made from, so you can recompute it on your own computer. It shows no payment, amount, merchant or customer, and you do not need to sign in.
The verifier is served by the platform, which is still a sandbox. Until it has its own address on ucrypto.co, the link below brings you back to this page.
Checking the ledger offline
-
Export the ledger
scripts/export-ledger.mjswrites every line up to a chosen checkpoint to one file, with no names, customers, merchants or card data in it. -
Recompute it yourself
scripts/verify-ledger-export.mjsneeds only that file and Node.js. It recomputes every fingerprint and the checkpoint's commitment, and names the first line that does not match. -
Compare with what was published
The commitment it recomputes must equal the one on the public checkpoint page. A file that has been changed does not match.
To check an export yourself, ask us for one through the contact page.
Anchoring and timestamps: not live yet
Checkpoints are published on the platform's public checkpoint page. They are not yet anchored to a public blockchain, and they do not yet carry RFC 3161 timestamps from an outside timestamp authority. Both wait on the owner's decision D26 and on requirement CHN-006.
In the sandbox, any anchor or timestamp the checkpoint page shows is labelled a test record made by our own software. It proves nothing outside our own systems, and we never describe it as being on a public blockchain.
Card data: PCI DSS SAQ A
uCrypto is built so that no card number, CVV or track data ever reaches our servers, databases or logs. Every card field belongs to the card acquirer, which keeps the platform in the smallest card scope, PCI DSS SAQ A.
- No uCrypto page has a card field.
- Only the last four digits of a card are ever kept, for the receipt.
- The database and the log files are scanned for card numbers on every release and every day.
- Text people type is refused if it holds a card number.
- Our hosted payment pages refuse to be shown inside another website, except the approved drop-in button, and load nothing from another website.
This describes how the platform is built and tested. It is not a statement of compliance or certification: the self-assessment is completed and signed at launch. No card acquirer is live today.
Identity and screening at purchase
Before a customer's first purchase, we screen them against sanctions and politically exposed persons lists, and a possible match stops their purchases until our compliance team has looked at it. A customer who wants to buy more than their limit is asked to prove who they are with an identity-check partner first.
The screening and identity-check partners are third parties that are not chosen yet. In the sandbox, made-up test stand-ins answer instead.
Service status
uCrypto is a sandbox and is not open to merchants or customers yet, so there is no public status page. One will be linked here before launch. Until then, ask us about the sandbox's state.
Reporting a security problem
If you think you have found a weakness in uCrypto, please tell us privately and do not publish it. Email compliance@uqt.ae with "SECURITY" in the subject.