Tuckpay

How Tuckpay protects your money

No verification does not mean no control: certifications, encryption and two-factor authentication work for every account.

Certifications and audit

ISO/IEC 27001

The international standard for information security management. The service's protection system is certified by an accredited body against the current version, ISO/IEC 27001:2022.

SOC 2

An independent audit of service organizations built on trust criteria: security, availability and integrity of data processing. The audit is carried out by an independent firm.

SOC 2 is an independent auditor's report, not a certificate. The report is provided on request.

Two-factor authentication

A second factor confirms sign-in and sensitive actions even if your password becomes known to someone else.

Available factors

  • TOTP app

    One-time codes in an authenticator — Google Authenticator, 1Password, Aegis, etc.

  • Telegram confirmation

    The action is confirmed with a button in the official Tuckpay Telegram bot.

Protected actions

  • Signing in
  • Issuing a card
  • Top-ups
  • Changing security settings

How to enable 2FA

  1. 1

    Open the Tuckpay Telegram bot and go to Security.

  2. 2

    Tap “Enable 2FA” and choose a TOTP app.

  3. 3

    Scan the QR code with the authenticator and enter the confirmation code.

  4. 4

    Save the backup codes.

Keep the backup codes separately from your phone: without them, access cannot be restored.

Technical controls

Encryption in transit

All traffic between the apps, the bot and the servers runs over TLS 1.3.

Encryption at rest

Databases and backups are encrypted with AES-256; keys are stored separately.

Least privilege

The team only accesses the systems needed for the job, and only for the task's duration.

Audit logging

Sensitive operations are recorded in a tamper-evident log with timestamps.

Incident response

A response plan with roles, escalation and user notification is in place.

Penetration testing

Independent specialists regularly test the service for vulnerabilities.

PCI DSS scope segregation

Card data is processed in an isolated zone, separate from the rest of the system.

What depends on you

  • Use an email address you don't share with other services.

  • Enable 2FA right after signing up.

  • Make sure you are writing to the official Tuckpay bot and channels.

Tuckpay never asks for your seed phrase, password or confirmation code — neither in chat nor by email.

Security questions

All questions

Ready to issue your card?

A Telegram account, card issuance in minutes, top-ups in USDT.

Get a card