Coynitt is designed so customer funds are not used for lending or operating expenses. Transfers may still be delayed or reviewed when required for fraud prevention, sanctions screening, or AML obligations. Here's exactly how the system is built, and what we do to make sure every layer is locked down.
Coynitt is designed so customer funds are not used for lending or operating expenses. When you fund a transfer, value moves from your Coynitt-provisioned wallet through a Coynitt smart contract, then out to your recipient's local rail. The settlement contract is open-source and undergoing independent audit ahead of public launch.
This is a deliberate structural choice. It does not mean a transfer can never be delayed — transfers may still be reviewed when required for fraud prevention, sanctions screening, or AML obligations.
Two independent audit firms are reviewing our RoundsFactory and HarambeeFactory contracts ahead of public launch. RFPs are out; final selection lands before sandbox-to-production cutover. Audit reports will be published on this page when complete.
The contracts themselves: github.com/appe-latte/Coynitt/contracts.
We use Sumsub for identity verification — the same compliance partner used by Coinbase, Wealthsimple, and dozens of other regulated fintechs. Your ID photos and selfie are encrypted in transit and at rest. Sumsub deletes raw uploads after we approve you; we retain only the verification result and the FINTRAC-required record fields.
Found something? Email security@coynitt.ca. We respond within one business day. We don't have a paid bounty program yet — we will once volume warrants — but we will name and thank responsible disclosures publicly with your permission.
