← Back to home
Merchant Security Guide

Stay sovereign.
Stay safe.

Accepting Bitcoin means you are your own bank. That is the whole point, and it comes with responsibility. This guide covers everything you need to keep your funds, your privacy, and your business secure. Read it once, set things up properly, and you can operate with confidence.

01
Keep your business wallet separate

The single most important rule. Your business wallet and your savings should never be the same wallet.

Use a fresh hardware wallet for receiving payments
Buy a new hardware wallet dedicated only to your business. Never use the same wallet that holds your savings, treasury, or long-term investments. A new device costs little and is the foundation of everything else in this guide.
Sweep funds to cold storage regularly
Do not let large balances accumulate in your receiving wallet. When your business wallet builds up a meaningful amount, move the bulk of it to a separate cold storage wallet that has never been exposed publicly. Keep only what you need for operations in the business wallet. A wallet whose addresses are published on invoices should never hold your life savings.
Treat the business wallet as semi-public
Every invoice exposes a receiving address derived from your ZPUB. Anyone you transact with can observe those addresses. Assume your business wallet activity is visible and plan accordingly. The less it holds, the less anyone can learn about your finances.
02
Protect your seed phrase

Your seed phrase is the master key to your funds. Anyone who has it can take everything. Anyone who loses it loses everything.

Never type your seed phrase into anything connected to the internet
Not into a website, not into a chat, not into a notes app, not into a photo. Your seed phrase should only ever exist on paper or steel, generated and stored offline. BoreLine Pay will never ask for it. No legitimate service ever will.
Back it up on metal, not paper
Paper burns, fades, and gets water damaged. Stamp or engrave your seed phrase onto a steel backup plate and store it somewhere secure. Consider a second copy in a separate physical location in case of fire or theft.
Tell no one
Do not share your seed phrase with business partners, family, support staff, or anyone claiming to help. If someone needs access to business funds, set up a proper multi-signature arrangement instead of sharing a seed.
03
Guard your privacy

Bitcoin is transparent by design. Every transaction is public forever. A few habits keep your financial life private.

Understand that addresses link together
When you spend from multiple addresses in one transaction, you reveal that they belong to the same wallet. This is called common-input ownership. Be mindful when consolidating funds, since it links your receiving addresses together on the public ledger.
Move to private storage in deliberate steps
When sweeping business income to cold storage, send it to a fresh wallet that has no public association with your business. Avoid mixing business funds with personal funds in a way that links your identity to your savings.
Do not publicly tie your name to your business wallet
Avoid posting your business ZPUB or addresses anywhere that links them to your real identity. The more separation between your public business activity and your personal holdings, the safer you are.
04
Secure your operations

Your API key, your website backend, and your devices are part of your attack surface. Lock them down.

Protect your API key like a password
Your API key lets a website create invoices on your account. Store it as a server-side environment variable, never in client-side JavaScript, never committed to a public code repository, never pasted into a support chat. If it leaks, replace it immediately from your dashboard.
What happens if your API key leaks
Good news, your funds are never at risk from a leaked API key. The API key can only create invoices and read your basic profile. It cannot touch your wallet, change your ZPUB, redirect payments, or access any funds. Every payment address is derived from your registered ZPUB, which an API key cannot change. So even in the worst case, all customer payments still flow to your own wallet, never to an attacker. The only nuisance a leaked key allows is someone creating spam invoices on your account. The moment you suspect a leak, open your dashboard and generate a new key. The old one stops working instantly.
How to add your API key without exposing it
Your API key belongs on your website's backend, never in the browser. The rule is simple. Any code a visitor can view by opening their browser developer tools must never contain your API key. Here is how that looks on common setups. On a custom site, store the key as a server-side environment variable and call BoreLine Pay from your backend, never from front-end JavaScript. On Shopify, do not paste the key into theme files or script tags, since those are public. Instead use a small server-side app, a serverless function, or an approved app that holds the key on its own backend, and have your storefront call that. On WordPress or WooCommerce, store the key in wp-config.php or your plugin settings, which live on the backend, not in a page template. The principle never changes. The customer's browser asks your backend to create an invoice, and your backend, holding the key privately, talks to BoreLine Pay. The key never travels to the customer. You never run any Bitcoin server yourself. BoreLine is the payment server. Your backend only makes a single API call to us.
Always verify webhook signatures
Every payment webhook is signed and timestamped. Verify the signature and reject anything older than five minutes before granting access to a customer. This stops attackers from forging fake payment confirmations. Your Integrate page has the exact code.
Keep your devices clean
The device you use to access your dashboard and sign messages should be free of malware. Keep your operating system updated, avoid pirated software, and consider a dedicated device or browser profile for business operations.
Multiple API keys, if your plan includes them
On the Business plan you can create more than one API key, for example one per website or team member. Each key can be revoked on its own from the dashboard without affecting the others, so if one leaks you cut off just that key. Every key, no matter how many you hold, only ever creates payments to your one registered wallet. Keys can never point anywhere else, and creating or revoking them does not touch your wallet. Give each key a clear name so you know what it is for, and revoke any you no longer use.
Payment links are safe to share publicly
Your no code payment links are meant to be public. A link only does one thing, it opens a payment page for a product you defined, and that payment goes straight to your registered wallet. A link contains no API key, no wallet details, and no amount that anyone can tamper with. Even if someone copies or edits your link, they cannot redirect a payment, change your products, or reach your account. The worst anyone can do is pay you. The link is the safe, public front door, your API key is the private back door, never mix the two.
05
Recognise scams

Most losses in Bitcoin come from social engineering, not broken cryptography. Know the patterns.

Anyone asking for your seed phrase is a scammer
There are zero exceptions. Not support, not an admin, not a security alert, not a wallet upgrade. The instant anyone asks for your seed phrase or private key, you know it is an attack. Walk away.
Verify who you are talking to
Scammers impersonate support staff on messaging apps and social media. BoreLine Pay only ever provides support by email, and we will never message you first asking you to take urgent action with your wallet. If someone contacts you claiming to be BoreLine Pay support and creates pressure or urgency, stop and verify through official channels.
Check every link and address twice
Fake websites and clipboard-hijacking malware can swap addresses. Always confirm you are on the correct domain before signing in. When verifying your receiving addresses, compare them directly against your hardware wallet screen, which is the one display an attacker cannot fake.
06
Your account login

BoreLine Pay uses your Bitcoin wallet as your login. This is stronger than any password, but understand how it works.

Signing in is a signature, not a password
There is no password to steal. To sign in, you sign a one-time message with your hardware device, a bit like a fingerprint that proves the device is really yours. This never reveals your private key or seed phrase, and you never type or share them. Even if someone knows your username, they cannot reach your account without your physical hardware device. Once signed in, your dashboard session stays active across page refreshes for up to one hour of inactivity, then asks you to sign in again. Keep your hardware device safe and your account is safe.
ZPUB changes are protected by a 48 hour hold
Changing your registered ZPUB takes two separate signatures, one from your current hardware device to authorize the change and one from the new device to prove you own it. After both are verified, the change is still held for 48 hours before taking effect, and you can cancel instantly during that window. Even someone inside your account cannot reroute your payments without your physical current device. This gives you both a hard cryptographic gate and time to react.
Your username is just a label, not a secret
Your username is only how you find your account at sign in. It is not a secret and it cannot be used to access anything on its own. There is no password tied to it. Even if someone knows your username, they cannot sign in, change your ZPUB, or touch your funds without a signature from your physical hardware device. The thing to protect is your hardware device and its seed phrase, not your username.
07
What happens if something leaks

Security is about layers. Here is exactly what an attacker can and cannot do in each scenario, so you understand how protected you really are.

If your ZPUB leaks on its own
A ZPUB is view-only. Someone who has it can see your receiving addresses, your transaction history, and your balance for that wallet. They cannot spend your funds, cannot sign in, and cannot change anything. A leaked ZPUB is a privacy concern, not a theft risk. This is exactly why we recommend a separate business wallet and regular sweeping. The less it holds, the less anyone learns.
If someone learns your username
Your username alone gives an attacker nothing of value here. They still cannot sign into your dashboard, because signing in requires a signature from your physical hardware device. They cannot start a ZPUB change either, because that can only be initiated from inside an authenticated dashboard session, and it then needs a signature from your current hardware device. Your funds and your account stay out of reach.
If your ZPUB leaks and your username is known
Even in this worst case, your funds stay safe. An attacker holding both still cannot sign into your dashboard, because that requires a signature from your hardware device. And even if they somehow reached an open session, they still cannot change your registered ZPUB, because a change now demands a fresh signature from your current hardware device to authorize it, then a signature from the new device, then a 48 hour hold. Without your physical device, the key can never be rerouted. The one thing you must always keep safe is your hardware device and its seed phrase.
How a ZPUB change actually works

Two separate signatures and a 48-hour hold, so no single point of failure can reroute your funds.

  1. Authorize with your current device. Sign a unique challenge with your existing hardware wallet. This alone stops a stolen login session, a hijacked cookie, or anyone inside your account, without your physical device in hand, the change cannot even begin.
  2. Prove the new device. Sign a fresh message with your new hardware wallet to prove you control the new ZPUB too.
  3. 48-hour security embargo. Your current ZPUB stays fully active and keeps receiving the whole time. You can cancel at any point during the hold.
  4. Switch-over. When the 48 hours complete, the new ZPUB takes the place of the old one, and payments arrive at its addresses from that moment.

Logging in is a separate signature from authorizing a change, so even an attacker sitting in an open session cannot reroute your payments without your current device.

01/3
Verify it yourself · free for life

Don't trust us. Verify us.

The best way to be sure about how BoreLine works is to test it yourself, with nothing at stake. Use the free Genesis tier to do exactly that:

  1. Register a fresh ZPUB from a brand new wallet that holds zero funds.
  2. Open the Verify page and check the derived addresses against your wallet, then approve them.
  3. Create an invoice for a tiny amount, 5 dollars for example.
  4. Pay that invoice yourself and watch exactly where the money lands. It goes straight to your wallet.
  5. Repeat as many times as you like. Wait for each payment to confirm in your own wallet before the next.

You never have to trust us, and you can check everything for as long as you want. The flow never changes, it is hard coded. Once you have seen it work with your own eyes and your own coins, you can register your real business wallet with confidence.

Test it yourself on the free Genesis tier: register a fresh empty wallet, create a small invoice, pay it, and watch the money land straight in your own wallet.

Checklist

Your security checklist

✓Fresh hardware wallet dedicated only to the business
✓Seed phrase backed up on metal, stored offline, shared with no one
✓Large balances swept to separate cold storage regularly
✓API key stored server-side, never exposed publicly
✓Webhook signatures verified before granting access
✓Receiving addresses verified against the hardware wallet screen
✓Confident that no one will ever get your seed phrase
✓Dedicated hardware wallet
✓Seed on metal, kept offline
✓Big balances in cold storage
✓API key kept server-side
Disclosure

Found a bug or security issue?

Responsible disclosure is genuinely welcome. If you find a bug, a vulnerability, or anything that looks off, please email borelineapp@proton.me. For a suspected security issue, report it privately first and give us a chance to fix it before it goes public. BoreLine Pay will never ask for your seed phrase or private keys, and neither will anyone legitimate.

Responsible disclosure is welcome. Email borelineapp@proton.me, and report security issues privately first. We never ask for your seed.

Swipe, use the arrows, or your ← → keys
08
Verify our server is honest

You do not have to trust that BoreLine hands out the right receiving address. You can check every one, automatically, against your own key.

An open-source verifier re-derives every address from your own key
Checking a few addresses by hand does not scale, and a compromised server could serve correct addresses for the ones you check and substitute the rest. So the same derivation runs as a verifier you run yourself. It pulls your invoice list and re-derives each address from your own ZPUB, flagging any that does not match, before you ever share the link. Because your key comes from you and the code comes from our public repository, a compromised server cannot pass the check by handing over a matching fake. It never sees your private key and cannot move funds. See how it works.
You can even verify the verifier
A built-in self-test derives the published BIP84 specification vector, an anchor defined by the Bitcoin standard rather than by us, and checks it against the known addresses, so you can confirm its maths is honest no matter who shipped the file. And you can run the whole thing offline: if it still works with your network off, it cannot be sending anything anywhere. Both tools live in the verifiable-core repository as a single HTML file and a command-line script.

Set up properly once, and you can run your Bitcoin business with total peace of mind.

See plans and pricing →