Security
Your keys. Your crypto. Your privacy.
Security and privacy sit at the core of Terra Wallet. Everything is engineered around non-custodial, on-device protection - so you stay in full control of your funds.
A+ security grade — zero findings
Terra Wallet passed a full independent third-party security audit by Certaris across code security, fundamentals and operations — earning a 96/100 AAA Trust Score and a clean report with zero findings at every severity. Safer than 100% of rated wallet projects.
Sector standing — rated wallets
- Certificate
- CERT-YUKEHNHMF
- Issued
- Jun 16, 2026
- Auditors
- Certaris Security Team
- Audit period
- Jun 2 – 16, 2026
Security features that protect your assets
Layered safeguards built into every part of the wallet - from key generation to the moment you sign a transaction.
Non-custodial by design
Private keys are generated and stored only on your device, never on our servers - we literally cannot access your funds.
Biometric login
Unlock with Face ID or fingerprint, backed by a 6-digit PIN and configurable auto-lock.
On-device encryption
Keys are encrypted at rest with AES in the device secure enclave / keystore and never leave it in plaintext.
Auto-lock & privacy
The app locks automatically in the background, hides balances on demand, and clears the seed from the clipboard.
Anti-screenshot
Sensitive screens such as your recovery phrase block screenshots and screen recording.
Scam & spoof protection
Address-poisoning warnings, spam-token filtering and a verified-asset badge help you spot fakes.
Continuously scanned & monitored
Terra Wallet undergoes continuous automated security scanning using industry-standard tools including Semgrep and OWASP methodologies, so the wallet you trust stays hardened.
Powered by Semgrep
Static analysis scans our code for security flaws on every change.
Automated vulnerability scanning
Continuous scanning catches issues before they ship.
Dependency monitoring
Third-party libraries are watched for known vulnerabilities.
OWASP methodologies
Tested against the OWASP industry security standards.
Regular security reviews
Ongoing reviews keep the wallet hardened over time.
Security is at our core
Security is layered. Your recovery phrase is created on-device using audited cryptographic libraries and is never transmitted. It is encrypted with hardware-backed keystores and gated behind your biometrics and PIN. The app cannot reveal it without your explicit authentication.
When you transact, Terra Wallet signs everything locally - your keys never touch a network. Connections to blockchains and third-party services (price feeds, swap routers, RPC providers) are made only to fetch public data or broadcast transactions you have already approved. dApp connections via the in-app browser and WalletConnect always require an explicit, readable approval before any signature.
We continuously reduce the blast radius of human error: address-poisoning alerts, spam-token hiding, a verified-asset badge for genuine tokens, and clear transaction previews help you avoid scams and costly mistakes.
Your right to privacy
We use data responsibly and ask for as little as possible - because the best way to protect your data is not to collect it.
Self-custody
Your keys, your crypto. We never access, store or transmit your private keys or recovery phrase.
No personal tracking
We do not sell your data or profile your activity for advertising.
No sign-up required
Create a wallet in seconds. No email, no account, no KYC to hold your own crypto.
Raising the bar even further
We believe in being transparent about what is shipped and what is coming. These initiatives are in progress - we will publish results here as each is completed.
ISO 27001 alignment
We are aligning our internal processes with the ISO 27001 information-security framework as we scale.
Public bug-bounty program
A formal, rewarded responsible-disclosure program is in preparation. Until launch, you can still report issues to our security team.
Recurring re-audits
Beyond our completed Certaris A+ certification, we will commission periodic re-audits with each major release and publish every updated report here.
What Terra Wallet never does
- ✓We never store, transmit, or have access to your private keys or recovery phrase.
- ✓We never take custody of your funds and cannot freeze, move, or reverse your transactions.
- ✓We never sell your personal data or track your activity for advertising.
- ✓We never ask for your recovery phrase - no legitimate support agent ever will.
Frequently asked questions
Is Terra Wallet safe to use?
Terra Wallet is non-custodial, so you alone hold your keys. They are generated on your device, encrypted at rest with AES in the hardware keystore, and gated behind your biometrics and PIN. We never receive or store them.
Can Terra Wallet be hacked?
Because there is no central server holding your keys, there is nothing for an attacker to breach to take your funds. The most important safeguard is keeping your recovery phrase private - anyone with it controls the wallet, so we never ask for it and neither should anyone else.
Where are my private keys stored?
Only on your device, inside the secure enclave / Android keystore, encrypted with AES. They never leave your phone in plaintext and are never transmitted to us or any third party.
What happens if I lose my device?
Your funds live on the blockchain, not the phone. Reinstall Terra Wallet on a new device and restore with your 12 or 24-word recovery phrase to regain full access. Without that phrase, no one - including us - can recover the wallet.
Has Terra Wallet been audited?
Yes. Terra Wallet completed a full independent third-party security audit by Certaris (June 2026), earning an A+ security grade and a 96/100 AAA Trust Score with zero findings across all severities - rated safer than 100% of evaluated wallet projects. The live certificate is verifiable at certaris.org. On top of the audit, our code is continuously scanned with automated tooling (Semgrep and OWASP methodologies) and our dependencies are monitored for known vulnerabilities.
How does Terra Wallet protect me from scams and phishing?
The app warns you about address-poisoning attempts, filters spam tokens, shows a verified-asset badge for genuine tokens, previews transactions in plain language, and requires an explicit, readable approval before any dApp or WalletConnect signature.