Questions, answered without spin

Plinth is a non-custodial stablecoin payment gateway: USDC on every network, and EURC on Arc. Each payment gets a unique address, or the customer signs a gasless authorization from a wallet. A watcher verifies the transfer on-chain, and a restricted relayer sweeps the funds, minus a 0.20% platform fee, to a vault that you own or to a payout wallet you choose. The gateway holds no key that can move merchant funds.

Yes, on Arc mainnet, in USDC and EURC. The contracts have not been independently audited, so start with small amounts and do not hold more value than you can afford to lose. Other networks open one at a time, each after its own on-chain check.

The token the payment was created in: USDC on every network, and EURC on Arc, where Arc lists it. Customers can pay from a connected browser wallet with one gasless signature (where the token supports it), or send the token to the unique address on the checkout page. A different token sent to a deposit address is recorded as the wrong asset and is never swept.

Several transfers add up. If the payment expires with only part of the amount it becomes underpaid. More than the amount is overpaid, with the excess recorded and refundable. Funds that become final after expiry are a late payment. Each case emits its own webhook event, so nothing is silently absorbed.

Funds sent to an address on a chain where the invoice contract does not exist cannot be matched automatically, and nobody holds a key for that address, so they may be unrecoverable. The checkout warns about this prominently. Keep the transaction hash and contact support.

A refund is a new transfer that you send from the account that received the funds: your vault, or your payout wallet if you use direct payouts. Plinth cannot move those funds for you. You record a refund request, send the transfer, and submit its transaction hash. The refund completes only after the transfer is verified on-chain. The platform fee is not refunded, so a refund can return at most the net amount you received.

You do. Funds go from the customer to a per-invoice address and are swept, minus the platform fee, to the destination committed into that address: either a MerchantVault whose only authority is its owner, or a payout wallet you chose and confirmed by email. The gateway and its relayer have no role in either, so they cannot withdraw, change the owner or choose a recipient for an address that already exists.

A compromised relayer key cannot redirect funds: sweep() takes no arguments and only sends to the destination baked into the invoice contract. It cannot withdraw from a vault or change its rules, and its gas budget is capped. A total compromise of the backend is different: it cannot take funds at addresses that were already issued, but it could hand out new checkout addresses that pay an attacker, and a customer cannot verify an address by looking at it. Mitigations exist (the engine checks your signed payout choice before deriving an address, which stops tampering with the database alone) but they do not stop a compromised API process. With direct payouts the payout wallet's own key controls the money. The contracts are unaudited.

No. They are covered by unit, fuzz and invariant tests and by fork tests against the real USDC bytecode, but none of that is an independent audit. An audit is a precondition for any mainnet launch.

Possibly, by the token issuer. USDC and EURC can be paused or blocklisted by their issuer, and a blocked vault, payout wallet or invoice address cannot receive or sweep funds. Plinth has no control over this. The risk disclosure covers it in more detail.

It depends on the network's finality rule: one confirmation on Arc, and the finalized block on Ethereum (about 13 minutes). After that the relayer sweeps the funds in one transaction. No settlement-time guarantee or SLA is offered.

A platform fee of 0.20% of each payment, rounded down to the token's smallest unit, taken inside the settlement transaction and sent to the Plinth treasury. The contract caps any fee at 1% and that cap cannot change. If the treasury transfer fails, you receive the full amount and the fee is not charged for that payment. The relayer's gas is paid by the gateway and recorded, not billed. Today Plinth runs on testnets, so no real money moves.

Vault mode settles into a MerchantVault that only your owner address controls, with an optional settlement delay. Direct mode settles straight to a payout wallet you choose. Direct has no vault: the wallet's own key controls the money. It needs a signature from the wallet and a fresh sign-in (and, where an operator enables it, a confirmation link sent to your email), and a cooldown runs before it takes effect. New payments use the destination committed when their address was issued.

Listen for signed webhooks, not redirects. Fulfil on payment.confirmed for speed, or on payment.completed once the funds are confirmed inside your vault. Verify the Plinth-Signature header (HMAC-SHA256 over the timestamp and raw body), reject timestamps older than five minutes and deduplicate on event.id.

There is a sandbox: test keys (sk_test_) operate on testnets and no real money moves; the platform fee applies there too. The API publishes an OpenAPI 3.1 document at /v1/openapi.json. There is no official SDK or store plugin yet, so you call the REST API directly.

No. The sandbox asks for a business name, an email address and a password, and the engine contains no identity verification or sanctions screening. The compliance posture for a production launch has not been decided; the launch checklist assigns it to legal counsel. If you need these controls, they are your responsibility today.

No. There is no licence, registration, SOC 2, ISO or similar certification, and the legal pages are drafts that counsel has not reviewed. Whether your use of a payment gateway needs a licence depends on your jurisdiction, so seek your own advice.