Security
CoinYatra is built around a single principle: money movement must be provable. These are the controls that protect balances, verification data and settlement instructions.
Immutable double-entry ledger
Every credit and debit is written once with the running balance, an idempotency key and a reference to the originating deposit, order, swap or withdrawal. Ledger rows cannot be edited or deleted, by users or staff.
Two-factor authentication
Time-based one-time passcodes protect sign-in and are re-checked on withdrawal requests. Single-use recovery codes are issued at setup and consumed on use.
Row-level isolation
Database policies scope every read and write to the authenticated account. Sensitive tables such as 2FA secrets are unreadable by any client and only accessible to verified server routines.
Manual withdrawal review
Withdrawals are risk-scored on value, destination history and velocity. Elevated requests are held for compliance review, and funds are debited into a locked state until approved.
Encrypted settlement details
Payout account details are encrypted with AES-GCM before storage. Only masked identifiers are shown in the interface and in staff tooling.
Server-side execution
Pricing, fee calculation, ledger writes and approvals run on the server behind authenticated boundaries. The browser never holds privileged credentials.
Your responsibilities
- • Enable two-factor authentication before funding your account.
- • Always send deposits on the exact network shown for the address you copied.
- • Verify withdrawal addresses character by character; on-chain transfers are irreversible.
- • CoinYatra staff will never ask for your password, 2FA code or recovery codes.