Security at Thesma
Factual rules for staying safe — what Thesma does, and what it will never do.
Thesma never asks for seed phrases or private keys
No page, email, or support flow will ever ask for your seed phrase, private key, or recovery phrase. Anyone who does is not Thesma.
Wallets open only when you click
MetaMask (or your wallet) opens only after you press an explicit action such as Connect, Sign, or Pay — never on page load, and never silently in the background.
Every payment shows before it signs
Funding and checkout present the exact recipient, amount, and network before your wallet asks for a signature. Thesma's backend only prepares unsigned transfers and verifies receipts; it never holds your keys.
Verification is not payment
VERIFIED means the evidence passed — not that anyone was paid. SUBMITTED means a payout transaction exists — not that it settled. Only independent onchain reconciliation settles a payout.
Proof is public
Live and completed markets, payout receipts, and settlement evidence can be inspected on /markets by anyone, without an account.
Referral links stay on Thesma until you click
Links like thesma.vercel.app/r/… always open a Thesma page first, showing the organization, the campaign, and the referring creator. The external destination opens only after you press Continue — and destinations are stored server-side, validated to https, and never taken from URL parameters.
Report a security concern
Found something suspicious — a phishing copy of Thesma, a strange wallet prompt, or a vulnerability? Describe what you saw, including the full URL and (if a payment) the transaction hash, through the in-app Operator or the contact channel published on the live site. Include steps to reproduce; never include seed phrases or private keys.