Security
We cannot take your money. Not as a policy, as a matter of how it is built.
The payment goes from your customer to your wallet. We watch it happen and write it down. There is no point in the process where your funds pass through us.
The approval happens on your side of the line and the money goes straight to your wallet. That is why we could not move your funds even if we wanted to.
Where everything sits
Three places, and the important one is not ours.
Your device
Your keys
Made on your device, encrypted on your device, kept on your device. Never sent to us in any form.
You approve every payment with your face, your fingerprint or a security key. Nothing moves without it.
Ceodore
Your books
Invoices, customers, VAT and gains reports. Encrypted before they are stored, with a key belonging to your business alone.
Your public wallet addresses, which the blockchain already shows to everyone. That is how we read your transactions.
The network
Your money
Arrives directly from your customer and stays in your wallet. It never passes through us.
It is an ordinary wallet. Open it in Phantom or on a Ledger device whenever you like. It belongs to you.
Getting in
Passkeys rather than passwords. Your face, your fingerprint or a security key, which means there is no password for anyone to guess, leak, or trick out of you over the phone.
We ask again at the moment it matters. Changing payout details, adding someone to your team or exporting your data all prompt a fresh check, not just a session that started this morning.
You can see every device that has access and sign any of them out immediately.
If you lose your phone
We ask you to set up two ways in before you can take any money, because one way in is how people lose everything.
Your passkey follows you across your own devices, so a new phone gets you straight back to your books. Your wallet unlocks with a second passkey, an encrypted backup file you keep yourself, or people you nominated in advance.
What we cannot do is recover it for you. That is the trade for nobody being able to take it either, and we would rather say so plainly than bury it in terms.
Wallets
Watched, not held.
Four wallets across three chains. One connected for taking payment, the rest watched and valued for the books. Ceodore reads them and never holds a key to any of them.
Your data
In London, encrypted, and not for sale.
Everything stays in the United KingdomServers, database and backups, all in London, under UK law and UK data protection.
Encrypted before storageCustomer details and invoice contents are encrypted with a key belonging to your business alone. A stolen database is worthless without separate access we control tightly.
We do not want your identity documentsSign up with an email address. Verifying your company is optional and only there if you want the badge on your profile.
Nothing sold or sharedYour data is not sold, not shared with advertisers, and not used to train anything.
Take it with youExport everything, in full, whenever you like, without asking us.
Every change is loggedWho did what, when, from where. Exportable, and useful long before anyone needs it as evidence.
If Ceodore disappeared tomorrow, your money would not.
Your wallet is an ordinary one. The recovery phrase opens it in Phantom, in Backpack, or on a Ledger device, with no involvement from this company at all.
We also publish a free tool, openly, that opens your backup file on your own computer with no internet connection and no account. It is there so that reaching your own money never depends on us still being here. That is an unusual thing for a software company to build, and it is rather the point.
For the technical reviewer
The longer version, with the services and the boundaries drawn out.
If you want to know what runs where, what happens between a tap and a line in the ledger, and why we cannot reach your funds even in principle, there is a page for that.
Read the architecture