How Sweep keeps you safe
The safest money is money nobody else can touch. Sweep is built so that your bitcoin can only ever be moved by you. Here is how, and what we do to protect everything else.
Who does what
Sweep works with specialist partners. Here is exactly who does each job.
| The job | Who does it |
|---|---|
| Works out your round-ups and sends the instructions | Sweep |
| Connects to your bank, read-only, so Sweep can see your purchases | A specialist bank-connection provider |
| Checks your identity | Our regulated conversion partner |
| Collects the money for your round-ups from your bank | Our regulated conversion partner |
| Converts it to bitcoin and sends it to your wallet | Our regulated conversion partner |
| Holds your money | Nobody. It goes from your bank, through the conversion, to your wallet |
| Holds your bitcoin and its keys | Only you. On your phone, never with Sweep |
Your bitcoin: only you hold the keys
Your wallet is created on your phone. Its keys are stored in your phone's own secure storage, protected by your phone's lock. Sweep never sees them, never stores them, and cannot move, freeze or lose your bitcoin. If Sweep itself were ever broken into, your bitcoin would still be in your wallet.
Your twelve recovery words are the only way to restore your wallet on a new phone. Write them down and keep them somewhere safe and offline.
Your bank: read, not touch
Sweep connects to your bank through a specialist bank-connection provider. That connection lets Sweep read your purchases so it knows what to round up. Sweep never receives your bank username or password, and the connection cannot make payments.
The money for your round-ups is collected and converted to bitcoin by our regulated conversion partner, under the authority you give when you sign up. Sweep itself never holds your money.
Your account
You sign in with a one-time code sent to your email, so there is no password to steal or reuse. On your phone, Sweep can be locked with Face ID or your fingerprint. When you sign out, your sign-in is removed from that phone.
Your data
Everything sent between the app and Sweep is encrypted in transit, and your data is encrypted where it is stored. Every part of Sweep's service requires you to be signed in, and that is checked automatically before any change goes live. Our provider accounts are protected with phishing-resistant passkeys. We keep logs so that if something goes wrong, we can see exactly what happened.
What Sweep will never do
We will never ask for your twelve recovery words, by email, by phone, in a message, or in the app. Anyone who asks for them is trying to steal your bitcoin.
We will never ask you to send bitcoin to "verify" or "unlock" your account, and we will never phone you out of the blue.
Found a problem?
If you think you have found a security weakness in Sweep, please tell us at hello@sweepapp.io before telling anyone else, and give us a fair chance to fix it. We'll reply, keep you updated, and thank you.
If you think someone has got into your Sweep account, or you've been sent a suspicious message claiming to be Sweep, email us straight away.