Trust and security

SixStar watches public chains for your team and tells you when something changes. This page says what we keep, where, for how long, and how we protect it. The legal page is the full record and wins if the two ever differ.

The short version

• Read only. We read public chains. We never ask for a private key or seed phrase, never sign or send a transaction, and cannot move your funds.
• We keep what the service needs, and nothing more.
• We never sell or share anything tied to your team. That means your watched contracts and wallets, your address book, your alert channels, your alerts, your identity events and your staff's email addresses.
• You can see, correct or delete what your account holds by writing to legal@sixstarlab.com.

What we keep

For your account:

• Your sign-in email and your team name.
• Not your password. Your password never leaves your browser; we keep a keyed hash of a value derived from it, and a keyed hash of your one-time recovery code.
• One cookie that keeps you signed in for up to 30 days. Scripts on the page cannot read it, and it is sent only to our site. There is no other cookie and no advertising.

For the watch:

• What you add: contracts, networks, admin wallets, Safes, limits, named wallets and their known addresses, address book names and roles, rules, and where alerts go.
• What our service reads and sends: the addresses in control of each contract, the alerts it sent, and what it last read from the public chain, so a restart neither repeats an alert nor misses a change.
• A log of which member changed which setting, and when.

The legal page lists every item, including what each optional part keeps when you turn it on.

How we protect it

• Secrets are not kept in a form we can give back. API keys, bot check-in URLs, passwords and recovery codes are kept only as hashes. A key or URL is shown to you once.
• Alert channel addresses and webhook signing secrets are encrypted at rest with AES-256-GCM, under a key used for nothing else, and bound to your team, so a value copied to another team's record does not open.
• The Cloudflare API token you give us as an identity source is encrypted the same way. Give us read-only access only; we never need to change anything in your services.
• Every webhook we send is signed (Standard Webhooks, HMAC-SHA256), so your server can check it came from us. The API and webhooks page has code to check it.
• The API answers only to keys, never to a browser. A key has one scope, expires after a year, and can be revoked at once. Calls are limited to 60 a minute for each key.
• We do not follow redirects or send to private networks. A webhook address must be a public HTTPS host.
• Abuse limits do not store your IP address. We keep a keyed hash of it that changes every day.
• We log actions, never contents. Our logs record what was done on an account, without passwords, keys or the contents of requests.

Where it is kept, and who can see what

• Cloudflare hosts the site and its database.
• Blockchain data providers see the public addresses and amounts our checks read, which are public anyway. Safe's Transaction Service sees which Safes we ask about.
• Telegram, Discord, Slack, PagerDuty and email see only the alerts you choose to send there, and so does whoever runs a webhook address you give us.

How long

• Alerts are shown for 90 days.
• API call records are kept for 90 days.
• Watching stops on the day a period ends. Your account and past reports stay open to you for a month after that.
• An account that never paid is deleted once 30 days have passed since it was made, its last order and the last amount it was quoted.
• Paid orders, payments and invoices are kept, because tax law requires it.

Our data rule

Anything tied to your team is never sold or shared, and is used only to run the service for you. If we ever offer data, such as lists of addresses known to drain funds, it is built only from public chain data and public reports, and never shows who watches what. Anything else needs your opt-in first.

Reporting a security problem

If you find a security problem in SixStar, write to contact@sixstarlab.com with "Security" in the subject. Please give us a reasonable time to fix it before you publish it, and do not access other teams' data while testing. Never send us a key, seed phrase or password.