What protects your account, and what we ask of you
UNC holds balances that people have spent months earning, so this page sets out plainly what defends them. Everything described here is implemented today. Where something is planned rather than live, it says so.
We will not tell you that any platform is unhackable, because no honest one can. What we can tell you is which specific controls are in place, where the remaining risk sits, and what you can do about the part that is in your hands.
Every UNC account is tied to a verified person through eKYC — a government-issued ID and a liveness check — plus a Trust Circle of contacts who can vouch for you. Duplicate attempts are flagged and reviewed. This is what keeps the network from being drained by bots and farmed accounts, which is the failure mode that has hollowed out most mobile mining projects.
Losing a 12-word phrase is the single most common way people lose crypto for good. UNC replaces it: if you lose your device, a threshold of your Trust Circle contacts can collectively authorise recovery. There is no phrase to be phished, screenshotted, or stored somewhere it should not be.
Signing in and sending are two different permissions. A wallet transfer requires a PIN that is stored only as a bcrypt hash and never in readable form — so someone who gets hold of an unlocked phone still cannot move your balance. Repeated wrong PINs lock transfers on that account for a cool-off period rather than allowing unlimited guesses.
Accounts can be protected with an authenticator app (TOTP), and with Face ID or fingerprint unlock on iOS and Android. We recommend enabling 2FA before your balance is worth anything to anyone else.
Sign-in attempts, reset codes and PINs are all rate limited per source and locked per account after repeated failures. Account lockouts are held server-side, so they cannot be sidestepped by reinstalling the app, switching networks, or spreading attempts across many addresses.
Changing your password or PIN immediately invalidates every existing session on every device. If someone has your account open somewhere, a password change is enough to evict them — it does not wait for the old session to expire on its own.
All traffic runs over TLS. Passwords and PINs are stored as bcrypt hashes, never as recoverable text — we cannot read them, and neither can anyone who obtains the database. Identity documents are access-restricted and handled by a certified verification provider.
Every balance change is executed under a database row lock, so two requests arriving at the same instant cannot both spend the same funds. Transfers are also subject to daily limits that scale with your verification level.
Team, founder and treasury wallet addresses are public. Vesting is enforced on-chain from block 0 rather than promised in a document, so nobody — including us — can unlock an allocation early. You do not have to take our word for it; you can check.
Security work is continuous, not a certificate. We review the codebase for vulnerabilities on an ongoing basis and fix what we find. When we discover an issue that could have affected accounts or balances, we fix it first and then tell you what happened — including when the honest answer is that something should have been caught sooner.
An independent third-party audit of the chain pallets is planned before mainnet genesis, and a bug bounty programme is planned alongside it. Neither is live yet, and we would rather say so than imply a review has happened that has not.
If you believe you have found a security issue, email security@unctech.co with enough detail to reproduce it. Please give us a reasonable window to fix the issue before disclosing it publicly. We will not pursue legal action against researchers who report in good faith, avoid accessing or altering other people's data, and do not degrade the service for others.
Most accounts that are lost are not lost to a broken server. They are lost to a reused password, a convincing message, or an address pasted without checking. These six things matter more than anything else you can do:
Pre-mainnet UNC balances are pending allocations and may have no monetary value. On-chain transfers, once mainnet is live, are irreversible — we cannot recover funds sent to the wrong address. Regulatory treatment of UNC varies by country and is your responsibility to check. As with any early-stage project, there is execution risk. Do not participate with money you cannot afford to lose.