Protecting your account
You sign in with an email address and a password, or with a one-time code sent to your phone. Passwords are never stored in a readable form — the authentication service keeps a hash, and no screen, log or support tool can show anyone your password, including us.
- Use a password you use nowhere else
- Most account takeovers anywhere are reused passwords leaked from another site. A password manager solves this permanently.
- Keep the phone number current
- It is how a one-time code reaches you and how you get back in if you forget the password. A dead number is a locked door.
- Confirm your email
- An unconfirmed address cannot receive a reset link, which is the one thing you will want on the worst day.
ask for your password, a one-time code or a card number — in a chat message, an email or a phone call. Anyone who does is not us.
The boundary is the server, not the screen
This is the single most important security decision in Sebairo, and it is worth spelling out: permissions are enforced by Sebairo's servers, not by the screen. A bug in a screen cannot leak somebody else's data, because the screen never receives it — and neither can a modified copy of the app, because the refusal happens on the server, below all of them.
- Some fields are never readable
- Your sign-in email and phone number, for example, are shown only to you — no other user can read them, anywhere in the app.
- The negative case is tested
- Features ship only after we have checked, from an outside account, that a non-member sees nothing.
How money is handled
Sebairo never touches your card. Paying takes you to Stripe's own checkout, where the card details are entered and stay. What comes back to Sebairo is a result and a reference.
- Prices are decided on the server
- A tampered app cannot buy at an invented price — the price that counts is the one Sebairo has published.
- Credit follows Stripe, not the browser
- Your wallet is credited only when Stripe confirms the payment — and a retry never credits twice.
- Every movement leaves a record
- Top-ups, purchases and withdrawals each carry a reference you can quote to support, so a disputed amount is a lookup rather than an argument.
Staff powers are separate and recorded
Moderation powers are not part of the app you install — the server refuses them to any ordinary account. Where staff do act — removing content, suspending an account — the action is recorded with the reason.
Reporting a vulnerability
If you find a security problem, we want to hear about it before anyone else does. Write to support@sebairo.com with the word SECURITY in the subject line, and we will answer.
- What helps
- The exact steps, what you expected, what happened instead, and the time it happened. A screenshot beats a description.
- What we ask of you
- Test against your own account. Do not access, modify or delete anyone else's data, and give us a reasonable window to fix it before publishing.
What Sebairo has not built yet
A security page that lists only strengths is a marketing page. These are the gaps as they stand today, and they will be removed from this list when they are closed and not before.
- No end-to-end encryption
- Messages are encrypted in transit and at rest, but the service can read them. See the Privacy page for what that means in practice.
- No app-based two-step verification
- Sign-in today is a password or an SMS code. An authenticator app is not available yet.
- No independent audit or bug bounty
- Sebairo has not been through a third-party security audit and runs no paid bounty programme. Reports are still very welcome — they are just not paid.
Questions people actually ask
Short answers. If yours is not here, the Help Centre answers in more depth.
Can anyone at Sebairo see my password?
No. Only a hash is stored, and there is no screen or tool that can reverse it. That is also why we can only reset a password, never tell you the old one.
I lost my phone. What now?
Change your Sebairo password from another device immediately — that is the fastest way to protect the account — and contact support if you cannot get back in.
Someone messaged me claiming to be Sebairo support.
Report the message and block the account — the callout under “Protecting your account” above says what we never ask for.
Is my payment safe?
Yes — the card step happens on Stripe, and your wallet is credited only on Stripe's confirmation.
How do I report a vulnerability?
Email support@sebairo.com with SECURITY in the subject. Test only against your own account.