Trust
Trust & Security
This page is maintained by Cash Stash to answer common security and hosting questions.
Who controls your money
Cash Stash uses Privy “app-managed server wallets”. Privy (part of the Stripe group) stores each wallet’s key as split shares and only rebuilds it inside a hardware-isolated secure enclave to sign. Cash Stash’s server is the only party that can ask Privy to sign a transfer. No additional Privy signing keys, approval quorums or Privy spending policies are switched on today, so Cash Stash’s own checks (your authenticator, release rules, proof checks and urgent-case pauses) are what decide whether a transfer is sent. You do not hold a private key or seed phrase.
| Who controls the wallet | Privy holds the key shares inside secure enclaves; Cash Stash’s server instructs it. You hold no key. Recipient wallets you add stay controlled by their owner. |
|---|---|
| Who can change a recipient | You, while signed in to your account. A Cash Stash administrator can also correct a recipient’s email address (for example after a typo you report); they cannot add a new recipient. |
| Who checks proof | Cash Stash — automated checks first, with a person reviewing where a rule asks for evidence (for example a document or photo). |
| Who can stop a pending release | You, by pausing or cancelling the rule. Cash Stash pauses releases automatically while an urgent case (disputed death report or compromised account) is open. |
| When a transfer becomes irreversible | Crypto: once the network confirms it (usually seconds to minutes) — it cannot be reversed. Bank payouts: once Stripe has paid them out to the recipient’s bank. |
Getting your money out quickly
Your money is yours to take out at any time. These are the quickest ways, fastest first.
- Send it to your own wallet. On the Digital Cash page, schedule a payment to your own wallet address (for example an exchange account) with today's date. It is released as soon as it is due. Network fees apply; there is no Cash Stash fee.
- Stop earning interest first, if it is switched on. USDC earning interest is usually available straight away, but a very large amount can take longer. Staked ETH goes through a queue that usually takes 1 to 5 days. Staked SOL is usually released within a few days.
- Send it to a US bank account. Connect and verify your bank through Stripe. The first payout can only leave 24 hours after the bank is added; after that, use "Withdraw now". The Cash Stash fee is 1%, or 0.5% for 1,000 or more.
- Plan ahead. Add your own wallet or bank now, so the waiting period is already over when you need the money. Sign-in and two-step checks still apply.
- Holds. An open urgent case can pause payouts until it is resolved.
Go to Digital Cash to start, or use Report a problem in your account if anything gets stuck.
Independent audits — whose, of what, and when
Each report belongs to the organisation named and covers only the system listed. A provider’s audit does not cover Cash Stash’s own software.
| Organisation | System covered | Report | Date | Evidence |
|---|---|---|---|---|
| Privy (Stripe group) | Wallet key storage and signing infrastructure used for Cash Stash wallets | SOC 2 Type II | Audit period 1 Nov 2025 – 1 Feb 2026 (announced 13 Apr 2026) | Privy announcement |
| Privy (Stripe group) | Shamir secret-sharing library that splits wallet keys | Independent code audit by Cure53 | February 2023 | Cure53 report (PDF) |
| Stripe | Card payments, subscriptions and bank payouts | PCI DSS Level 1 and SOC reports | Renewed annually; current date on Stripe’s page | Stripe security |
| Supabase | Database, sign-in and file storage behind Cash Stash | SOC 2 Type II | Current date on Supabase’s page | Supabase security |
| Amazon Web Services | Data-centre hosting under the services above | SOC 1, 2 and 3 | Issued twice yearly; current date on AWS’s page | AWS SOC reports |
| Cash Stash (Digitalsurfing Limited) | Cash Stash’s own app, release rules and proof checks | No independent audit yet | — | Our own security practices (this page) |
Who helps when something goes wrong
Families, executors and account holders can open an urgent case for a disputed death report, a compromised account or a missing or failed payment at Urgent help. Cases go to the monitored Digitalsurfing Limited inbox (ds@digitalsurfing.co.uk) with automatic reminders after one business day and an overdue alert if a deadline is missed. We acknowledge within 2 UK business days and take a first action within 5 UK business days. Disputed death reports and compromised accounts pause releases from the matched account until reviewed.
If you lose your phone or authenticator app
- Your scheduled messages and money rules keep working — losing your phone does not cancel, release or change anything.
- If you set up a second authenticator app, sign in with it and remove the lost one under Security.
- If you have no other authenticator, open an urgent case ("Compromised account"). We check your identity by email and the details on your account before removing the lost authenticator. While the case is open, money releases and wallet changes on your account are paused.
If a transfer fails
- Failed or unclaimed transfers are retried automatically on the schedule in Terms clause 11A, and the recipient is reminded.
- If the main recipient cannot be reached, the gift amount stays in your account. Once all your gifts and tasks have finished, any remaining amount passes to your fallback person. If nobody claims, the money stays frozen in your wallet for your estate — Cash Stash never keeps it.
- If you are expecting a payment that has not arrived, open an urgent case ("Missing or failed payment") and quote the date and recipient.
If a death report is wrong
- Anyone — including the account holder — can dispute a death report by opening an urgent case ("Disputed death report").
- When the account is matched, every pending release that depends on a death report is paused straight away and stays paused until we have reviewed the case. Nothing is ever released early because of a dispute.
- A check-in by the account holder also cancels a presumed-death status.
If if Cash Stash should ever close
- We will give at least 90 days’ notice by email to every account holder, trusted contact and executor we hold.
- From the notice date no new money can be added. Living account holders can withdraw their funds to their own wallet or bank during the notice period.
- For account holders who have passed away, money goes to the named recipient, then to the fallback person, then is held for the estate — exactly as it would if the service carried on.
- Cash Stash and Digitalsurfing Limited never take ownership of customer money on closure.
Recovery exercises
We test our recovery procedure and publish the date and real outcome of each exercise, including anything that went wrong. Data is backed up weekly by Cash Stash; our hosting provider also keeps its own daily database snapshots for about 14 days.
No exercise has been published yet.
Hosting and infrastructure
Cash Stash runs on Amazon Web Services (AWS). AWS is the only cloud infrastructure provider we use to host, store, and back up platform data.
We do not use Google Cloud, Microsoft Azure, Alibaba, Tencent, Oracle Cloud, Heroku, DigitalOcean, or any other listed infrastructure provider to store Cash Stash user data. Our database and object storage are provided through the Lovable Cloud platform, which is backed by AWS infrastructure.
Security practices
- Encryption in transit: all traffic between your browser and Cash Stash is protected by TLS.
- Encryption at rest: data stored in our database and storage buckets is encrypted at rest by AWS.
- Row-level security: database access is enforced at the row level, so users can only read and modify their own records.
- Secrets vault: API keys, tokens, and other secrets are held in a restricted vault and never exposed to the browser.
- Limited access: administrative access is limited to a small number of authorised staff.
- Backups: public database tables are backed up weekly into a private AWS storage bucket.
No system is perfectly secure. Keep your sign-in credentials safe and tell us promptly if you suspect unauthorised access.
Vulnerability management and patching
We maintain a defined and repeatable process for identifying, prioritising and applying security patches to the software behind Cash Stash.
- Identification: automated dependency vulnerability scanning of third-party packages, static application security testing of our source code, and automated database access-control scanning on every backend change. We also monitor security advisories from our hosting and backend providers.
- Prioritisation: each issue is rated by CVSS severity and adjusted for real-world exploitability. Targets are 7 days for critical, 30 days for high, 90 days for medium, and routine maintenance for low.
- Application: patches ship through our standard build and release pipeline. Every change is built and type-checked before deployment, releases are versioned and can be rolled back, and scans are re-run afterwards to confirm the issue is resolved.
- Underlying infrastructure: we do not operate our own servers or operating systems. Operating-system, hypervisor and network-layer patching is handled by AWS and our managed backend provider.
Reporting a vulnerability: if you believe you have found a security vulnerability, email ds@digitalsurfing.co.uk before disclosing it publicly so we can investigate and fix it. This mailbox is monitored with automatic reminders: reports are acknowledged within 2 UK business days and receive a first action within 5 UK business days.
Backend vulnerability testing
We run structured backend vulnerability testing against the Cash Stash web application, its APIs, and the database access layer. The goal is to find and fix security weaknesses before they can be exploited.
- Scope: testing covers the public-facing website, authenticated API routes, server-side business logic, and the database access layer. It does not include third-party infrastructure or social-engineering exercises.
- Methods: we use automated dynamic application security testing (DAST) and automated web vulnerability scanning to identify common issues such as injection flaws, broken access control, and insecure configuration.
- Frequency: vulnerability tests are run at least once every 12 months, and sooner after any major infrastructure or authentication change.
- Triage and remediation: findings are rated by severity and tracked to completion. Critical issues are fixed within 7 days, high-severity issues within 30 days, and medium issues within 90 days.
- Validation: we re-test after fixes to confirm vulnerabilities are resolved and do not reappear in the same form.
Detailed methodology and scope are documented in the Cash Stash backend vulnerability testing policy.
Subprocessors and integrations
We share data only with the processors and integrations we need to run the Service. Each processor is bound by a data-processing agreement that limits use of your data to the service they perform for us.
| Provider | Purpose |
|---|---|
| Amazon Web Services (AWS) | Cloud hosting, database storage, backups, and object storage |
| Supabase | Managed database, authentication, and storage services |
| Stripe | Subscriptions, card payments and bank payouts |
| Privy (Stripe group) | Wallet key storage and transaction signing for Cash Stash wallets |
| Twilio | SMS delivery |
| Email delivery providers | Transactional and scheduled email delivery |
Private message links sent by text can be opened by anyone who has the link, so share them only with the intended recipient.
Data deletion and privacy
You can request deletion of your personal data at any time. For details about what we store and how deletion works, see the User Data Policy and the Data Deletion Status page.
For security vulnerability reports, email ds@digitalsurfing.co.uk. For privacy questions, email ds@digitalsurfing.co.uk. We respond to verified requests within 30 days.
Platform fact
Cash Stash is built on the Lovable platform. Lovable Cloud provides the managed backend, authentication, and storage services that Cash Stash uses. The underlying infrastructure for those services is AWS.