YieldBoltTrust & Security
Your account, funds, and data — protected by design.
This page is maintained by the YieldBolt team to answer common security and privacy questions about the platform. It describes controls currently enabled in the app.
Encrypted in transit
All traffic between your browser and our servers is served over HTTPS/TLS.
Per-user data isolation
Database Row-Level Security ensures every user can only ever read their own profile, balance, stakes, deposits, withdrawals and history.
Human-in-the-loop payouts
Every deposit and withdrawal is manually reviewed by an authorised admin before funds move.
Authentication & account safety
Email + password sign-in with secure password reset via one-time codes sent to your inbox.
Sessions are managed by our authentication provider using industry-standard tokens; you can sign out from any device at any time.
Passwords are never stored in plaintext and are never visible to YieldBolt staff.
Admin accounts are provisioned manually — there is no public path to escalate your own account to admin.
Data isolation & access control
User data lives in a managed PostgreSQL database with Row-Level Security (RLS) enabled on every user-owned table (profiles, stakes, deposits, withdrawals, transactions, referrals, notifications).
Every policy is scoped to
auth.uid() — one user's session token cannot read or modify another user's records, even by guessing IDs.User roles are stored in a dedicated
user_roles table (never on the profile), and admin checks run through a security-definer database function to prevent privilege-escalation bugs.Referral commissions and referred-user visibility are also gated by RLS — you only see the users you referred, no one else.
Financial controls
Deposits: submitted with a transaction hash and screenshot, then verified against the on-chain payment before your balance is credited.
Withdrawals: your balance is debited when you submit the request, and the payout is dispatched once the request is processed. Rejected withdrawals are automatically refunded to your balance.
Stakes: return amount, duration and maturity date are locked in at purchase and cannot be changed retroactively — payouts credit automatically at maturity via a server-side function.
All balance-changing operations go through server-side stored procedures with the caller's identity verified. Clients cannot directly write to balance columns.
Auditability
Every balance change writes a row to your transactions ledger — deposits, withdrawals, stake purchases, stake returns and referral commissions are all timestamped and visible to you in History.
Deposit and withdrawal status (pending, approved, rejected) is visible to you at all times.
In-app notifications alert you the moment an admin approves or rejects a deposit.
Platform & hosting
The application backend runs on managed cloud infrastructure (Supabase / PostgreSQL) with automated backups and encryption at rest handled by the provider.
File uploads (deposit screenshots) are stored in a dedicated bucket with user-scoped upload paths; users can only upload into their own folder.
Secret keys (service-role credentials, wallet keys) are never exposed to the browser and never committed to source code.
Shared responsibility — what you can do
Use a strong, unique password for your YieldBolt account. Never reuse passwords from other services.
Double-check the deposit wallet address shown in-app before every transfer — always paste directly from the app, never from an email or chat.
Do not share your login code, reset code, or session with anyone. YieldBolt staff will never ask for these.
Report anything suspicious (unexpected balance changes, unknown login) to us immediately.
Security contact & responsible disclosure
Not a certification. This page describes controls currently enabled in the YieldBolt application. It is not an independent audit, and it does not constitute a guarantee of any regulatory certification (e.g. SOC 2, ISO 27001, PCI). Staking of digital assets carries market risk; nothing here is financial advice.