How SwissBorg protects your crypto: our security breakdown
SwissBorg protects your crypto against hackers and scammers in layers: custody kept apart from our own assets, keys that never exist in one place, an account that only works from your phone, and withdrawal locks you set for up to 180 days.
Is SwissBorg safe?
Security isn't a single feature, it's a system. We protect your crypto in three layers, so no single safeguard carries it alone:
- Ownership and segregation: your crypto stays your property, held by BlockNodes SAS, our entity in France authorised by the AMF under MiCA. It is kept apart from our own assets and would not form part of the company's estate if it ever became insolvent.
- MPC key protection: private keys never exist in one place, and every transaction must pass our approval rules before it can be signed.
- Control on your side: the app only works from a device you approved, and you can lock your crypto withdrawals for up to 180 days.
Custody: your crypto stays yours
BlockNodes SAS, our MiCA-authorised entity in France, is the custodian of users' crypto-assets. Users' crypto-assets can be held together in shared wallets, each balance tracked in the ledger, and you can check that your own balance is included in our latest monthly audit. To execute orders, a small share is held with exchanges that are themselves authorised under MiCA.
Your property
Your crypto-assets remain yours at all times. We cannot use them for our own account without your explicit consent.
Kept apart from ours
They sit on different wallet addresses from the company's own crypto, with separate legal and accounting records. A ledger, updated in real time and regularly checked against the blockchain, records each user's balance.
Ring-fenced in an insolvency
If BlockNodes SAS became insolvent, users' crypto-assets would not form part of its estate.
MPC: no single key to steal
The keys to users' crypto are protected with multi-party computation (MPC) technology from Fireblocks, and from Cordial Systems for assets Fireblocks does not support. Each private key is split across several independent systems and never exists in one place, so no single party - not a technology provider, not our own team - can use it alone.
Before anything is signed, a policy engine checks the transaction against rules we set. Some transactions are approved automatically, others need a person to approve them, and changing the rules needs approval too.
Withdrawal protection: a time lock on your crypto
Withdrawal protection puts a delay of 1 to 180 days, chosen by you, on every crypto withdrawal and on Smart Send. Once a withdrawal is requested, the funds cannot move until the delay is over.
The delay cannot be shortened or lifted early, not even by our support team. Turning protection off takes the same delay before withdrawals without delay resume. Even if someone gets into your phone or forces you to open the app, they would have to wait out the full delay before any crypto leaves your account, which gives you time to react. Buying, selling and exchanging in the app work as usual.
You can also share a page that confirms, on the date it was checked, that withdrawal protection was active on your account.
Proof of solvency: check that your balance is counted
Every month we publish an audit of user balances, with every account anonymised. You can check for yourself that your own balance is included in the latest audit, without sharing any personal data.
Account security: your account is tied to your device
Signing in and moving funds need two things: the phone you set up and something only you know.
A key on your phone
When you set up the app, your phone creates a device key that never leaves it. Every sign-in and sensitive action is signed with that key.
Your PIN or passphrase
Sign-ins and withdrawals also need your PIN or passphrase. Too many wrong attempts lock the account until you pass extra checks. You can use biometrics instead of typing it.
Passkeys for a new phone
Moving to a new phone takes your passkey and your PIN. A passkey is tied to your device and your account, which makes it far harder to phish than a password.
A 48-hour freeze after key changes
After a manual account recovery or a change of phone number or email, withdrawals pause for 48 hours. We email you about each change, so you can report it if it was not you.
Calls announced in the app
Before one of our team calls you, the app sends a push notification with their name. Treat a call, SMS or WhatsApp message without that notification as fraudulent.
Two factors, explained
Why we use your device and your PIN as the two factors, instead of SMS codes.
Regulation and licences
BlockNodes SAS, our entity in France, is authorised by the Autorité des marchés financiers (AMF) as a crypto-asset service provider under MiCA, the EU's crypto-asset regulation. Its authorisation covers custody and administration of crypto-assets, order execution, placing, investment advice, portfolio management and transfer services.
Scam and phishing prevention
Scammers pretend to be SwissBorg, and sometimes a regulator such as the AMF or FINMA, to get you to move your crypto. Their usual story is that your account has been breached and your funds must be moved to a "safe" wallet. Neither SwissBorg nor the authorities will ever ask you to move, withdraw or "secure" your funds.
If anything feels wrong, stop, hang up and contact us through the in-app Support before you act.
SwissBorg will never
ask for your recovery phrase, PIN, password or any verification code
ask you to move, withdraw or "secure" your funds
call you without a notification in the app first
ask for remote access to your device or to install a screen-sharing app
ask you to call a phone number to confirm or cancel a change to your account
give support through social media
Our official channels
Support: in the app, or support@swissborg.com if you cannot open the app
Calls: always announced first by an in-app and a push notification with the caller's name
Emails: only from @swissborg.com addresses - check for lookalikes such as "support@swissborg" without ".com"
Website: swissborg.com, help.swissborg.com and the web app at app.swissborg.com
App: only from the Apple App Store and Google Play
Security issues: security@swissborg.com
Security testing
As a crypto-asset service provider authorised under MiCA, we must also meet the EU's Digital Operational Resilience Act (DORA), which requires us to test our systems regularly. Every year, our security team runs internal security audits, and an independent firm carries out an external penetration test.
Frequently asked questions
SwissBorg protects users' crypto-assets in several independent layers, so their protection does not rest on a single control. The crypto-assets remain the users' property, are kept separate from the company's own assets and are held by BlockNodes SAS, a custodian authorised under MiCA by the French AMF.
The keys to those assets are protected with multi-party computation (MPC), so the full key never exists in one place, and a policy engine checks every transaction before it can be signed. On the user's side, the account only works from a device they approved, and they can add a time lock of up to 180 days to their crypto withdrawals.
Security does not remove market risk: the value of crypto-assets can go down as well as up. See how custody works.
SwissBorg is not a scam. In the EU, the SwissBorg app is operated by BlockNodes SAS, which the Autorité des marchés financiers (AMF) has authorised as a crypto-asset service provider under MiCA, the EU's crypto-asset regulation, with licence number A2026-011. SwissBorg also publishes an audit of anonymised user balances every month, which any user can check their own balance against.
Scammers do pretend to be SwissBorg. Genuine emails only come from @swissborg.com addresses, every call from the team is announced first by a notification in the app, and SwissBorg never asks for your password or one-time codes. See SwissBorg's licences.
Yes, for the crypto-asset services listed below. BlockNodes SAS, SwissBorg's entity in France, is authorised by the AMF as a crypto-asset service provider under MiCA (Regulation (EU) 2023/1114), licence A2026-011.
The authorisation covers custody and administration of crypto-assets, order execution, placing, investment advice, portfolio management and transfer services. MiCA also sets rules on how clients' crypto-assets are kept separate from the provider's own. Visit the MiCA transparency hub.
Your crypto-assets stay your property and SwissBorg cannot use them for its own account without your explicit consent. They are kept on different wallet addresses from SwissBorg's own crypto, and a ledger, updated in real time and regularly reconciled against the blockchain, records each user's balance.
The keys are split with MPC so no single party, including SwissBorg's own staff, can use them alone. On your side, sign-ins and withdrawals need your phone and your PIN, and you can lock crypto withdrawals for 1 to 180 days. Crypto prices can still go down as well as up.
Users' crypto-assets are not part of the company's estate. BlockNodes SAS keeps them segregated from its own assets, legally, in its accounts and on separate wallet addresses, and they remain the users' property, recorded in their name in the ledger. Under the Custody Policy they are not affected by an insolvency proceeding of BlockNodes SAS.
The same applies to fiat: users' funds are held with an authorised credit institution in segregated accounts, ring-fenced from SwissBorg's own funds. Read about fund ownership and segregation.
BlockNodes SAS, SwissBorg's MiCA-authorised entity in France, is the custodian. Users' crypto-assets can be held together in shared wallets, with each user's balance recorded in the ledger, and the keys are protected with MPC technology from Fireblocks, and from Cordial Systems for assets Fireblocks does not support. These providers supply the technology; BlockNodes SAS remains the custodian.
To execute orders, a small share of users' crypto-assets is held with exchanges that are themselves authorised under MiCA. Read the Custody Policy.
Multi-party computation (MPC) is a way of signing transactions without a complete private key ever existing. Each key is split into shares held on several independent systems, and the shares work together to produce a signature without being combined.
For users, this means there is no complete key stored anywhere for an attacker, a provider or an employee to steal. SwissBorg adds a policy engine on top: rules decide which transactions may be signed, some automatically and some only after a person approves them. See how MPC protects the keys.
Withdrawal protection is an optional time lock on your crypto withdrawals and Smart Send. You choose a delay from 1 to 180 days in the app's security settings, and once a withdrawal is requested the funds cannot move until the delay is over.
The delay cannot be shortened or lifted early, not even by SwissBorg's support team, and turning protection off takes the same delay. It is designed for the case where someone forces you to open the app: they cannot take your crypto out right away. Buying, selling and exchanging work as usual. Read how withdrawal protection works.
You withdraw crypto to an external wallet, or fiat to your bank account, from the SwissBorg app.
Two safeguards can add a wait. If you turned on withdrawal protection, crypto withdrawals wait for the delay you chose. And for 48 hours after an account recovery or a change of phone number or email, withdrawals are paused, which gives you time to react if someone else made the change. You get an email for each change and can report it if it was not you.
SwissBorg publishes an audit of user balances every month, with every account anonymised: it shows what SwissBorg owes its users. On the self-verification page you can check that your own balance is included in the latest audit, without sharing personal data.
Yes. As a MiCA-authorised crypto-asset service provider, SwissBorg must meet the EU's Digital Operational Resilience Act (DORA), which requires regular testing of its systems. Every year, its security team runs internal security audits and an independent firm carries out an external penetration test.
Anyone who finds a security issue can report it to security@swissborg.com.
Genuine SwissBorg emails only come from @swissborg.com addresses. Before anyone from the team calls you, the app sends a push notification with that person's name; treat a call, SMS or WhatsApp message without that notification as fraudulent.
SwissBorg never asks for your password, one-time codes or full sign-in details, never asks you to move funds to a "safe account", and never asks you to send crypto to verify your identity. If in doubt, stop and contact support@swissborg.com. See how to protect yourself from scams.
Email security@swissborg.com with a description of the issue and the steps to reproduce it. Please do not test against other users' accounts or share the issue publicly before it is fixed.
For suspected fraud on your own account, contact support@swissborg.com.
Report a vulnerability
If you think you have found a security issue in SwissBorg's apps, website or systems, email security@swissborg.com with a description and the steps to reproduce it. Please do not test against other users' accounts or share the issue publicly before we have had the chance to fix it.