Security
Your safety is our priority.
Your wallet keys are created inside a sealed hardware enclave and never leave it in plaintext. Mo can't read them, and neither can Coinbase or AWS.
Principles
Self-custody, without the seed phrase.
Mo doesn't make security theatrical. Your keys are generated and used inside a Trusted Execution Environment that Mo cannot reach, and you get to them with the login you already use.
Wallets are self-custodial. Coinbase Developer Platform generates your keys inside an AWS Nitro Enclave, where nobody at Mo, Coinbase, or AWS can read them, root and admin included.
You sign in with email or a social account and recover the same way. There is no seed phrase to write down or lose.
Every signature happens inside the enclave. Your key is decrypted and used within that boundary and never exists in plaintext outside it. Credentials are ECDSA on the secp256r1 (P-256) curve.
Every transfer is screened against the OFAC sanctions list by Coinbase Developer Platform before it is submitted onchain. A transfer to a sanctioned address is blocked, not broadcast.
Customer data Mo stores is hosted in AWS us-west-2 (Oregon, United States).
Mo keeps minimal data. Personal information is redacted where possible. The only identifiers Mo records in full are email and wallet address.
Full PII for banking and travel fulfilment is handled by partners (Dakota for banking, Nuitee for travel/stays), and is not retained in full by Mo beyond what those flows require Mo to see transiently.
Internal access to customer data follows least privilege. Team members only see what they need for support, compliance, or operations.
Report security vulnerabilities or concerns to legal@mo.xyz. We review responsible disclosures and respond as quickly as we can.