Compare
Where the money sits decides who you have to trust
This compares two models, not companies. It names none and says nothing about any real product. Use it to decide which kind of risk you would rather carry.
Category by category
Descriptions of each model in general terms. A particular product may differ on any row.
| Category | Custodial processor model | Non-custodial vault settlement (Plinth) |
|---|---|---|
| Where funds sit while a payment is in flight | In an account the processor controls. The merchant's balance is an entry in the processor's books. | At an address that can only ever pay the merchant's vault. No account balance exists on the gateway side. |
| Who can move settled funds | The processor, and the merchant through the processor's permission system. | Only the vault owner, an address the merchant chooses. The gateway has no role in the vault. |
| If the operator is compromised | Funds held in the operator's accounts are exposed to the compromise. | By design the operator cannot withdraw or redirect. Service can still be disrupted. |
| If the operator disappears | Access depends on the operator, its processes and its jurisdiction. | Funds already swept stay in the vault under the owner's key. Pending payments depend on someone running the relayer. |
| Settlement path | Customer to processor account, then payout to the merchant on the processor's schedule. | Customer to invoice address to merchant vault, in one sweep transaction after finality. |
| Who pays network gas | Whoever the processor's model assigns it to. | Wallet payments are gasless for the customer. The relayer pays sweep gas and records the cost. |
| Reversals and refunds | Can be initiated from inside the processor's account. | A refund is a new transfer the merchant sends from the vault, proven by its transaction hash. |
| Account recovery | A support process can restore access. | A lost owner key cannot be recovered by anyone. A multisig owner is recommended. |
| Trust you extend to the operator | Custody, plus correct bookkeeping and solvency. | Correct detection and status, and uptime. Not custody. |
What you take on
- You manage a key. Losing it loses access to the vault.
- Your balance is in USDC. Plinth does not convert to or pay out in other currencies.
- The token issuer can block addresses, and a blocked vault cannot be paid.
- The contracts are not independently audited, and Plinth runs on testnets only.
- Refunds need you to send a transfer yourself; there is no refund button that works without your key.
When this model fits
- You want customers' payments to land in an address you control, with a short list of what the gateway can do.
- You are comfortable operating a wallet or multisig, and you can wait for an audit before taking real value.
- You want status derived from on-chain facts and delivered through signed webhooks.
Judge the claims yourself
The security page lists who can do what, and the limitations that apply today.