Trust & Security

How Moni protects your funds and data — and how you can verify every claim yourself.

Do not trust. Verify.

Github DeepWiki

You can feed any AI model with GitHub docs to verify our security yourself. You can also chat with a codebase on a DeepWiki 😊

Core Security Principles

Open Source

The code running in your browser is publicly available. You can review it, audit it, and verify how the extension works.

Verified Distribution

The extension is reviewed and distributed via the Chrome Web Store. Every permission is explicit and transparent.

Self-Custodial

Your keys remain yours. Private keys never leave your wallet and are never accessible by the extension or our servers.

Zero Key Access

We do not store private keys, seed phrases, or sensitive credentials. No clipboard access, no hidden data collection.

Trusted Infrastructure

All transaction signing is handled through audited providers such as Turnkey. Your keys remain fully under your control.

Browser Permissions

Permission	What This Allows	What This Does Not Allow
storage	Lets the extension read and write to its own isolated storage space.	Does not give access to cookies, localStorage, or storage used by other extensions.
sidePanel	Allows us to show the side panel UI inside the browser.	Does not allow reading page content or interacting with other extensions’ panels.
identity	Lets the extension start OAuth flows when authentication is needed.	Does not provide access to the user’s Google account data or Google services.
webNavigation	Lets us listen to navigation events for specific tabs we work with.	Does not allow reading page content, modifying requests, or tracking full browsing history.
system.display	Allows querying display configuration to adjust UI behavior.	Does not allow screen capture or reading positions of other applications’ windows.
tabs	Lets the extension check tab state and send messages to a tab.	Does not grant permission to read page content without host permissions or inject scripts anywhere.

Client Architecture

We designed the extension so that almost all logic runs directly on the client side. This keeps data local to the user's browser and minimizes whatever needs to reach our servers. We follow Manifest V3 and rely only on vetted, well-maintained third-party libraries.

For every release, we publish the full build bundle and the exact package that goes to the Chrome Web Store. We also provide clear instructions so anyone can reproduce the build from the source tree and compare the results.

Each tagged release includes a checksum. Auditors can verify that the checksum of the published bundle matches the one listed in the release notes and confirm that the bundle's contents match the source code.

Server-Side Features & Data Handling

On the server side, we keep the architecture simple, strict, and transparent:

• We use role-based access control so only authorized team members can perform staff or admin-level actions.

• We log all privileged operations for full auditability.

• We encrypt all backups and regularly test recovery procedures to ensure reliability.

What We Never Do

• We never store private keys or seed phrases

• We do not access clipboard data or monitor user input beyond explicit actions

• We do not run background processes such as mining

• We do not collect or transmit full browsing history

Only minimal contextual data, such as the current active page, is used when required for specific features.

Contacts and Feedback

If you have questions, suggestions, or want to report an issue, you can reach out via the Chrome Web Store support channel or directly through the Moni team. Support & Feedback