Who can move your company's money
inzi prepares operations: payouts, invoices, reconciliation. inzi cannot move a client’s money on its own: the key shares inzi holds are not enough to sign, and someone who breaks into inzi gets no more than that. That is how the keys and signatures are set up, and you can check it. What still carries risk — an operation slipped in for signing, the client’s device, access to the dashboard — and how to check what you sign are described below.
In short
The embedded wallet's key is split into three shares, and signing needs two. inzi holds only one of them in plain form. The second is stored with us encrypted by the client's passkey — we do not have the key to it. The third is on the client's device. In a Safe treasury, inzi has no keys among the owners at all.
Who can move the money
| Who | Can they? | Why |
|---|---|---|
| The company (owner) | Yes | Signs with its own passkey, its own wallet or a Ledger. In a treasury, only with a set of signatures that meets its own threshold. |
| Team member (admin) | Only prepare | Prepares a payout and sends it for signature. The owner signs; the server refuses to let an admin sign. |
| inzi | No | One key share out of three in plain form is not enough. The cold share is encrypted with the client's passkey. A daily automated check tells us if any share turns out not to be under the client's key. |
| Someone who hacked inzi | No | Gets the same as inzi has. They may try to slip an operation in for signing — see section 3. |
| Safe, Squads | No | Open contracts on the network; the companies that build them take no part in signing. |
| Circle (USDC issuer) | Only freeze | As the issuer, Circle can freeze an address when the law requires it; the same goes for Tether with USDT. |
| Fiat provider (Transak) | Only what was sent to it | Receives exactly the amount the client signed to send it. |
What inzi sees
We see and store
- Recipients, amounts and the purpose of payouts, invoices and payment requests
- Operation history and on-chain statuses
- Team members' email addresses and roles
- Billing details for our subscription invoices
We do not see or store
- The passkey and the private key
- The backup file: it is assembled in the signing window, in the client's browser, and downloaded straight away
- Keys of a Ledger or of external wallets
- The money: it always sits at the client's addresses
How to make sure you sign what you mean
A separate signing window on sign.inzipay.com
The dashboard can neither sign by itself nor change what the window shows: the recipient and amount are taken from the signed data itself. The dashboard has no access to the key at all.
A check in the dashboard before a treasury operation is signed
Recipient, amount, token and treasury address.
The Ledger screen
The dashboard shows the same operation hashes as the Ledger.
No double payouts
A payout whose outcome is unknown is not sent again.
If the signing window itself were compromised
If the deployment of the signing window itself were compromised, it could show you a different operation — so the final check is the screen of your wallet or Ledger.
How to take your money out without inzi
- 01
Safe treasury
app.safe.global → connect an owner's wallet → the treasury's network (Base) → open the treasury by its address → transfer → collect signatures up to the threshold → send. The sender needs a little ETH for gas.
- 02
Unified balance (Circle Gateway)
From the wallet that owns the balance, call initiateWithdrawal on Circle’s Gateway Wallet contract (for example, through the network’s block explorer), wait out the 7-day delay, then call withdraw: the USDC returns to that address on the network where it was deposited. The sender needs a little of the network’s coin for gas.
- 03
Embedded wallet
Download the backup in advance (the Backup page, or Download backup on the wallet's page) → import the private key: EVM — MetaMask (Import account → Private key), Solana — Phantom, Tron — TronLink → check the address → transfer. The file gives full access to the money: keep it offline and never send it to anyone.
- 04
External wallet or Ledger
Nothing is needed: the money is already with the client.
- 05
Forwarding addresses
An independent withdrawal tool sends the remaining balance to the original address without inzi's servers.
USDT on Tron: what is protected and what is not yet
Protected
You sign a payout with one tap in the signing window; the key is the same 2-of-3 embedded wallet, and inzi cannot move the money. Up to 20 recipients get plain USDT transfers from your wallet; a longer list goes through the payout contract, which has no owner: it only debits in a transaction you signed, and it holds no funds. The energy provider only delegates a resource to your address — it has no access to the money.
Not yet
Multi-signature on Tron: a Tron wallet is signed by a single owner. Keep larger sums in the treasury on Base (several signatures) and working balances on Tron. Multi-signature on Tron is in progress.
Network risks
Tether can freeze an address at the request of authorities. “Tainted” incoming USDT can cause problems at exchanges — AML screening of incoming payments is in progress.
What is still in progress
- Treasury rules on-chain (an allowlist, a daily limit for a single signature): a ready-made Zodiac Roles module, tested on a Base fork; it is switched on for a treasury when its owners decide.
- Moving older keys under the signing window is ready (Move passkey).
- There has been no external audit yet. So far we rely on an internal security review, tools, AI review and live checks.
Internal security review: 29 Oct 2026
inzi is software. We do not hold clients' funds and do not transfer them on clients' behalf.