Privacy & Ledger TransparencyPre-Launch Sandbox & Testnet Prototype

Privacy, Data Tokenization & Public Ledger Policy

Last Updated: October 17, 2026 • Prototype Evaluation Release

Important Notice on Public Blockchain Testnets & Ledgers

Transactions dispatched via decentralized blockchain rails (such as Solana, XRP Ledger, Xahau, and Base L2) are broadcast to public ledgers. While bank account numbers are tokenized and masked in the application database, public wallet addresses, transaction hashes, timestamps, token transfer amounts, and ledger sequence numbers are publicly viewable on block explorers and cannot be deleted or modified once committed to a ledger.

1. Overview & Prototype Data Scope

InstaPay IPX (“we”, “us”, or “our”) operates a multi-rail payout orchestration prototype (MODE=prototype, TESTNET_ONLY=true). This page documents what data the prototype collects, how bank and wallet identifiers are stored in the database, and which controls are verified in code versus planned for production.

2. What the Prototype Collects & How It Is Stored

Tokenized & Masked Bank Counterparty Details

Pursuant to repository migration 065_purge_plaintext_account_numbers.sql, plaintext bank account (DDA) numbers are purged and not stored in the application database. When a sandbox bank transfer is submitted, the application exchanges the routing and account number for an upstream counterparty token (cpty_...) and persists only masked references (e.g., ACH-****7890 (021000021)) in payout and job records.

Public Blockchain Identifiers (On-Chain)

Public wallet addresses (Solana Base58 keys, XRPL/Xahau classic addresses, Base EVM hex addresses), transaction hashes, and transfer amounts are stored in the database for reconciliation and submitted to public testnet/devnet RPC nodes.

Profile & Onboarding Fields (Sandbox Evaluation)

Prototype onboarding forms collect basic merchant and worker profile fields (name, email, phone, mailing address) stored in PostgreSQL over TLS. Live government ID document verification (KYC/KYB) is not connected in prototype mode; do not submit real SSNs/EINs or sensitive personal documents during sandbox evaluation.

3. Data Retention Lock & PII Anonymization Architecture

The codebase implements programmatic data retention and PII scrubbing in src/compliance/DataRetentionService.ts:

  • Seven (7) Year Financial Record Hold: To model statutory recordkeeping requirements (31 CFR § 1010.430 and 26 U.S.C. § 6001), assertFinancialRetentionHold() blocks deletion of double-entry ledger journals, payout records, and audit logs until their 7-year retention_hold_until timestamp expires.
  • PII Segregation & Scrubbing: User and merchant profile PII is segregated from immutable ledger entries. When account anonymization is triggered, personal profile fields (names, emails, phone numbers, password hashes, sessions) are scrubbed and marked pii_anonymized = true while preserving the underlying financial ledger integrity.

4. Cryptographic Credentials & Target Hardware Roadmap

  • API Keys & Passwords: Merchant API keys are hashed with SHA-256 (key_hash) before storage; raw API keys are never persisted. User passwords and security PINs are stored as cryptographic hashes.
  • Shamir Secret Shares: Split-key shares generated by lib/crypto/mpcVault.ts are encrypted with AES-256-GCM. Client-device biometric hardware enclave shares (WebAuthn/Passkeys) and cloud HSMs are planned for production and are not active in the current prototype.

5. External Sandbox & Testnet Endpoints

When you trigger a test transaction in the prototype, relevant payload fields are transmitted over HTTPS/WSS to:

  • Developer Banking Sandboxes: Sandbox API endpoints (such as Column Sandbox or PayPal Sandbox) to test counterparty tokenization and ACH/RTP/PayPal payout lifecycles.
  • Public Blockchain Testnets: XRPL Testnet, Xahau Testnet, Solana Devnet/Testnet, and Base Sepolia RPC nodes.
  • Zero Sale of Data: We do not sell, rent, or monetize user or evaluation data.

6. Security Controls & Verification Scope

For a complete list of security controls verified by automated repository tests versus planned production infrastructure (such as HSMs, KMS rotation, and independent SOC 2 / penetration audits), please review our Security Architecture and Regulatory Disclosures pages.

7. Privacy & Data Inquiries

If you have inquiries regarding this policy or wish to request deletion of test profile data, contact: privacy@instapayipx.com.