The safest data is the data nobody collected.

The strongest thing we do is not collect it

Most of what leaks in a crypto breach is identity: scans of passports, selfies, addresses, dates of birth, the pile a company gathers to satisfy a check and then keeps forever. We never ask for any of it, so there is no pile. A breach of Phantom Ramp cannot expose documents we do not have.

This is a structural property, not a policy we could quietly change. There is no admin screen where your ID appears, because no code path ever writes one.

We never hold your coins

Coins go from the swap straight to the address you supplied. There is no custodial balance, no hot wallet holding customer funds, and nothing for an attacker to drain. The largest losses in this industry come from exchanges holding what was not theirs, and we structurally cannot.

Card details never reach us

Card numbers are entered into and held by our payment processor. Our systems see the last four digits, the expiry, and the result of the charge.

What we do hold

An email address, your transaction history, and the destination addresses you have used. That is the honest answer, and it is the list an attacker would get.

• Passwords are hashed with a memory-hard algorithm, never stored in a readable form
• Sessions are HTTP-only, Secure cookies, not tokens sitting in browser storage
• API keys are stored as hashes; the full secret is shown once at creation and never again
• Transport is TLS everywhere, with no plaintext fallback

What you are responsible for

The destination address, every time. We show the network in full on the confirmation screen because sending to the right address on the wrong chain is the single most common way people lose crypto, and it is not recoverable by anyone.

Use a wallet you control the keys to. If a wallet will not show you a recovery phrase, you do not control it.

Reporting a vulnerability

Email security@phantomramp.example with enough detail to reproduce it. We will confirm receipt, keep you updated while we fix it, and we will not threaten anyone who reports something in good faith.