Security at UNC

What protects your account, and what we ask of you

UNC holds balances that people have spent months earning, so this page sets out plainly what defends them. Everything described here is implemented today. Where something is planned rather than live, it says so.

We will not tell you that any platform is unhackable, because no honest one can. What we can tell you is which specific controls are in place, where the remaining risk sits, and what you can do about the part that is in your hands.

How your account is protected

One real human, one account

Every UNC account is tied to a verified person through eKYC — a government-issued ID and a liveness check — plus a Trust Circle of contacts who can vouch for you. Duplicate attempts are flagged and reviewed. This is what keeps the network from being drained by bots and farmed accounts, which is the failure mode that has hollowed out most mobile mining projects.

Recovery without a seed phrase

Losing a 12-word phrase is the single most common way people lose crypto for good. UNC replaces it: if you lose your device, a threshold of your Trust Circle contacts can collectively authorise recovery. There is no phrase to be phished, screenshotted, or stored somewhere it should not be.

A separate PIN to move funds

Signing in and sending are two different permissions. A wallet transfer requires a PIN that is stored only as a bcrypt hash and never in readable form — so someone who gets hold of an unlocked phone still cannot move your balance. Repeated wrong PINs lock transfers on that account for a cool-off period rather than allowing unlimited guesses.

Two-factor authentication and biometrics

Accounts can be protected with an authenticator app (TOTP), and with Face ID or fingerprint unlock on iOS and Android. We recommend enabling 2FA before your balance is worth anything to anyone else.

Brute force gets shut down, not slowed

Sign-in attempts, reset codes and PINs are all rate limited per source and locked per account after repeated failures. Account lockouts are held server-side, so they cannot be sidestepped by reinstalling the app, switching networks, or spreading attempts across many addresses.

Sessions you can revoke

Changing your password or PIN immediately invalidates every existing session on every device. If someone has your account open somewhere, a password change is enough to evict them — it does not wait for the old session to expire on its own.

Encryption in transit and at rest

All traffic runs over TLS. Passwords and PINs are stored as bcrypt hashes, never as recoverable text — we cannot read them, and neither can anyone who obtains the database. Identity documents are access-restricted and handled by a certified verification provider.

Balances that cannot be spent twice

Every balance change is executed under a database row lock, so two requests arriving at the same instant cannot both spend the same funds. Transfers are also subject to daily limits that scale with your verification level.

Public wallets and on-chain vesting

Team, founder and treasury wallet addresses are public. Vesting is enforced on-chain from block 0 rather than promised in a document, so nobody — including us — can unlock an allocation early. You do not have to take our word for it; you can check.

How we handle a problem

Security work is continuous, not a certificate. We review the codebase for vulnerabilities on an ongoing basis and fix what we find. When we discover an issue that could have affected accounts or balances, we fix it first and then tell you what happened — including when the honest answer is that something should have been caught sooner.

An independent third-party audit of the chain pallets is planned before mainnet genesis, and a bug bounty programme is planned alongside it. Neither is live yet, and we would rather say so than imply a review has happened that has not.

Reporting a vulnerability

If you believe you have found a security issue, email security@unctech.co with enough detail to reproduce it. Please give us a reasonable window to fix the issue before disclosing it publicly. We will not pursue legal action against researchers who report in good faith, avoid accessing or altering other people's data, and do not degrade the service for others.

The part that is yours

Most accounts that are lost are not lost to a broken server. They are lost to a reused password, a convincing message, or an address pasted without checking. These six things matter more than anything else you can do:

  • Turn on two-factor authentication in Account & Security.
  • Set a wallet PIN, and make it different from your phone unlock code.
  • Add 3–5 Trust Circle contacts you actually know, so recovery is possible.
  • Use a password you have never used anywhere else — reuse is how most accounts are lost.
  • Check the sender address character by character before a transfer. On-chain transfers cannot be reversed.
  • UNC staff will never ask for your password, PIN, 2FA code, or a payment to unlock a balance. Any message that does is a scam, however official it looks.

Risks we are not going to hide

Pre-mainnet UNC balances are pending allocations and may have no monetary value. On-chain transfers, once mainnet is live, are irreversible — we cannot recover funds sent to the wrong address. Regulatory treatment of UNC varies by country and is your responsibility to check. As with any early-stage project, there is execution risk. Do not participate with money you cannot afford to lose.