Reference
Security
What Sprout can and cannot touch, and how to spot a fake.
Sprout is built so that very little can go wrong, and what can, you can check yourself onchain. Here is what Sprout can touch, what it never can, and how to spot a fake.
What Sprout can and can’t touch
| Can Sprout touch it? | |
|---|---|
| Your seed phrase or private keys | Never. Sprout never sees them. |
| Your recipient’s money | Never. Once it lands, it’s theirs. |
| Your USDC balance | Only through autopay: one payment, on its due date, up to the cap you approved. |
| Other tokens in your wallet | Never. |
| A finished transfer | No one can reverse it, Sprout included. |
Sprout will never
- Ask for your seed phrase, recovery phrase or private key.
- Message you first on social media, or offer support in your DMs.
- Ask you to send funds to “verify” or “unlock” a wallet.
- Ask for an unlimited spending cap, or one on any token but USDC.
- Ask you to install anything besides the wallet you already use.
Check the domain
Sprout lives at one address. Before you connect a wallet or sign anything, check the address bar. Bookmark it, and don’t follow links from DMs or ads.
www.sproutpay.ccCheck what you sign
- Connecting asks you to sign a message. It’s free and can’t move funds.
- Autopay asks you to approve Sprout’s program as a delegate on your USDC token account. It should name USDC and a cap equal to what your plan still owes: $105.00 for a new $100.00 plan over 10 months.
- Payments are USDC transfers from your wallet for the amount on your plan page. Nothing else.
Everything is onchain
The transfer to your recipient and every payment you make are ordinary Solana transactions, each linked to a block explorer from your plan. You never have to take our word for it.
Revoking access
You can revoke autopay’s approval at any time, from the plan in Sprout or from your wallet. See Autopay.
Reporting a problem
Found something suspicious, or a site pretending to be Sprout? Email help@sproutpay.cc.