Who can move your company's money
inzi prepares operations: payouts, invoices, reconciliation. inzi cannot move a client's money — not on its own, and not if it is hacked. That is how the keys and signatures are set up, and you can check it.
In short
The embedded wallet's key is split into three shares, and signing needs two. inzi holds only one of them in plain form. The second is stored with us encrypted by the client's passkey — we do not have the key to it. The third is on the client's device. In a Safe treasury, inzi has no keys among the owners at all.
Who can move the money
| Who | Can they? | Why |
|---|---|---|
| The company (owner) | Yes | Signs with its own passkey, its own wallet or a Ledger. In a treasury, only with a set of signatures that meets its own threshold. |
| Team member (admin) | Only prepare | Prepares a payout and sends it for signature. The owner signs; the server refuses to let an admin sign. |
| inzi | No | One key share out of three in plain form is not enough. The cold share is encrypted with the client's passkey. A daily automated check tells us if any share turns out not to be under the client's key. |
| Someone who hacked inzi | No | Gets the same as inzi has. They may try to slip an operation in for signing — see section 3. |
| Safe, Squads | No | Open contracts on the network; the companies that build them take no part in signing. |
| Circle (USDC issuer) | Only freeze | As the issuer, Circle can freeze an address when the law requires it; the same goes for Tether with USDT. |
| Fiat provider (Transak) | Only what was sent to it | Receives exactly the amount the client signed to send it. |
What inzi sees
We see and store
- Recipients, amounts and the purpose of payouts, invoices and payment requests
- Operation history and on-chain statuses
- Team members' email addresses and roles
- Billing details for our subscription invoices
We do not see or store
- The passkey and the private key
- The backup file: it is assembled in the signing window, in the client's browser, and downloaded straight away
- Keys of a Ledger or of external wallets
- The money: it always sits at the client's addresses
How to make sure you sign what you mean
A separate signing window on sign.inzipay.com
The dashboard can neither sign by itself nor change what the window shows: the recipient and amount are taken from the signed data itself. The dashboard has no access to the key at all.
A check in the dashboard before a treasury operation is signed
Recipient, amount, token and treasury address.
The Ledger screen
The dashboard shows the same operation hashes as the Ledger.
No double payouts
A payout whose outcome is unknown is not sent again.
How to take your money out without inzi
- 01
Safe treasury
app.safe.global → connect an owner's wallet → the treasury's network (Base) → open the treasury by its address → transfer → collect signatures up to the threshold → send. The sender needs a little ETH for gas.
- 02
Embedded wallet
Download the backup in advance (the Backup page, or Download backup on the wallet's page) → import the private key: EVM — MetaMask (Import account → Private key), Solana — Phantom, Tron — TronLink → check the address → transfer. The file gives full access to the money: keep it offline and never send it to anyone.
- 03
External wallet or Ledger
Nothing is needed: the money is already with the client.
- 04
Forwarding addresses
An independent withdrawal tool sends the remaining balance to the original address without inzi's servers.
What is still in progress
- Treasury rules on-chain (an allowlist, a daily limit for a single signature): a ready-made Zodiac Roles module, tested on a Base fork; it is switched on for a treasury when its owners decide.
- Moving older keys under the signing window is ready (Move passkey).
- There has been no external audit; until there is a reason for one, we rely on tools, AI review and live checks.
inzi is software. We do not hold clients' funds and do not transfer them on clients' behalf.