Is stablecoin payment safe?

What non-custodial means in practice

Non-custodial. Kollect never takes custody; licensed partners hold funds during fiat legs. The distinction is structural rather than a policy that could change: the money does not pass through a Kollect balance, so there is no Kollect balance to be frozen, misappropriated or lost.

On the stablecoin-to-stablecoin rail there is no intermediary at all. The payment is addressed to a wallet you control from the moment it is created, so it never sits anywhere on its way to you. On the fiat legs a licensed partner takes custody for the duration of the conversion and payout, because moving fiat into a bank account is regulated activity and Kollect is not the licensed entity for it.

The practical consequence is worth stating plainly: a failure at Kollect cannot strand funds that were never Kollect's to hold.

How requests and webhooks are secured

API access uses API key + secret, HMAC-SHA256 signature, mandatory idempotency key. The signature covers the request, so a captured key alone is not enough to forge one, and the idempotency key means a replayed request resolves to the operation already performed rather than a second one.

Outbound webhooks are signed too: Signed via x-kollect-signature; kollect-server interface only. Verification happens against the raw request body, compared in constant time. A normal string comparison returns as soon as it finds a difference, and the time that takes leaks how much of the signature was right.

Sandbox isolation and social engineering

The sandbox runs on Sepolia (sandbox only), a separate network from the Ethereum mainnet and Polygon used for live payments. Test tokens have no value, so a sandbox mistake cannot become a real loss. The post-payment settlement timeline there is a labelled simulation rather than an unmarked one.

The likeliest attack on a payments product is not technical. Kollect will never ask for a private key, a seed phrase or a wallet signature, on any channel, for any reason. Any message that does is not from Kollect, and the security route on the contact page exists to report it.