1. Overview
This page describes how Etheroute approaches the rules that apply to a payments service: what the platform does and does not do, and what that means for you as a merchant. It is a statement of practice, not legal advice. Etheroute meets the obligations that apply to a service of its kind, and says plainly where the responsibility is the merchant’s.
2. Regulatory Position
2.1 Accounts and identity
A basic Etheroute account is opened with a username and a password. We do not collect names, identity documents or addresses, and we do not verify identity for basic accounts. We maintain the ability to implement KYC procedures when required by law, and will ask for what the law requires before continuing to serve an account that falls under it.
2.2 Anti-Money Laundering (AML)
Etheroute does not operate a bank-style transaction monitoring programme and does not screen individual payments. What it does do:
- Keeps a record of every wallet, payment and withdrawal, with the on-chain transaction it corresponds to
- Refuses service where the Terms of Service are breached, and may suspend an account or decline a withdrawal where there is reason to believe the platform is being used unlawfully
- Responds to lawful requests from authorities, as set out in the Privacy Policy
Merchants remain responsible for the obligations that apply to their own business in their own jurisdiction, including any registration, reporting or customer-verification duties that come with what they sell.
2.3 Prohibited use
The platform may not be used for any unlawful purpose, to move the proceeds of crime, or to evade sanctions. The Terms of Service list the prohibited activities in full.
3. Security Practices
The measures below are the ones in place today; each can be checked against the product.
- All traffic to the dashboard and the API is over TLS
- Wallet private keys are encrypted with AES-256-GCM before they are stored, under a key that is not kept with the data
- Passwords are stored as salted scrypt hashes; API keys are shown once and stored only as hashes
- Webhook deliveries are signed with HMAC-SHA256 so a receiver can verify they came from Etheroute
- Requests are rate limited per account and per address; withdrawals are limited more tightly than reads
- Password recovery uses one-time recovery codes issued at sign-up; there is no email reset
4. Funds and Keys
Etheroute generates the receiving wallets for your account and holds their private keys, encrypted, so that it can sign withdrawals on your behalf. Balances are yours to withdraw at any time to an address you control. A flat 5% platform fee and the network’s own fee are shown on the review screen before a withdrawal is confirmed; nothing else is deducted. When a wallet is closed, any amount below the withdrawal minimum that remains at its address is retained, as described in the Terms of Service.
Transactions on a public blockchain are visible to anyone and cannot be reversed once confirmed. The platform confirms a payment only after the number of blocks set for that network.
5. Privacy and Data Protection
We collect what the service needs to run and nothing about who you are. The Privacy Policy lists every category of data held, how long it is kept, and when it may be disclosed. We do not sell user data and do not share it with third parties except as that policy describes.
6. Contact & Support
For questions about anything on this page, please reach out to our team through our support channels. For a lawful request from an authority, use the email address below.