Security
CoinYatra is built around a single principle: money movement must be provable. These are the controls that protect balances, verification data and settlement instructions.
KYC identity verification
Identity verification confirms that each account belongs to a real, named person before they can trade on P2P. Submitted documents are reviewed by the CoinYatra team, and verification status also sets your account tier and daily limits.
Immutable double-entry ledger
Every credit and debit is written once with the running balance, an idempotency key and a reference to the originating deposit, order, swap or withdrawal. Ledger rows cannot be edited or deleted, by users or staff.
Two-factor authentication
Time-based one-time passcodes add a second layer to sign-in and are re-checked on withdrawal and internal transfer requests. Single-use recovery codes are issued at setup and consumed on use.
Passkey sign-in
Add a passkey in Settings to sign in with your device's fingerprint, face or screen lock instead of typing a password. Passkeys are tied to coinyatra.com, which helps protect against phishing sites. Email and password sign-in stays available.
Row-level isolation
Database policies scope every read and write to the authenticated account. Sensitive tables such as 2FA secrets are unreadable by any client and only accessible to verified server routines.
Manual withdrawal review
Withdrawals are risk-scored on value, destination history and velocity. Elevated requests are held for compliance review, and funds are debited into a locked state until approved.
Encrypted settlement details
Payout account details are encrypted with AES-GCM before storage. Only masked identifiers are shown in the interface and in staff tooling.
Server-side execution
Pricing, fee calculation, ledger writes and approvals run on the server behind authenticated boundaries. The browser never holds privileged credentials.
Your responsibilities
- • Enable two-factor authentication before funding your account, and consider adding a passkey for sign-in.
- • Always send deposits on the exact network shown for the address you copied.
- • Verify withdrawal addresses character by character; on-chain transfers are irreversible.
- • CoinYatra staff will never ask for your password, 2FA code or recovery codes.