E1Trust and moving countries1 min 17 sec
What Coinfig can and cannot see
Read-only keys, addresses only, your consent and your data: what Coinfig sees and never does.
Key points
- Coinfig uses a read-only key that stays at your exchange, so you can revoke it there at any time.
- For a wallet, give only the public address; Coinfig refuses a recovery phrase on the spot.
- API keys and other secrets are encrypted at rest with AES-256-GCM and never stored in plain text.
- An accountant can only work on your account after you accept their invitation and give consent.
- Coinfig does not send your history or tax reports to SARS, except if required by law or legal process.
Chapters
Learn more
- HelpSecurity at Coinfig
Read-only access, encryption and how your data is handled.
- HelpPrivacy Policy
What is collected, who processes it, and your POPIA rights.
- GlossarySeed phrase
Why no tax tool ever needs your recovery phrase.
- GlossaryPrivate key
How read-only keys and public addresses work instead.
- FeatureAccountant workspace tools
How client consent and access logging work for practices.
Keep learning
Episode 01
Link an exchange, 1 min 14 sec, watched
Connect an exchange with a read-only key and let your history sync itself.
A1Getting started
Your first five minutes, 1 min 7 sec, watched
From sign-up to your first figures: the shortest path through Coinfig.
C4Reports and your data
Take your data with you, 45 sec, watched
Export every source as CSV in one ZIP, or just the ledger view you filtered.
Read the transcript
Read-only. What does Coinfig actually see, and what can it never do?
Coinfig asks for a read-only key wherever the exchange offers one. The screen says it plainly: Coinfig can never move your funds. Each exchange guide says which permission to tick, and which to leave off. Your key lives at your exchange, so you can revoke it there at any time.
For a wallet, Coinfig needs only the public address. Never your recovery phrase. Paste a recovery phrase and Coinfig refuses it on the spot. Delete a source, and its credential and imported data are removed with it. Coinfig asks you to confirm first.
An accountant can only work on your account after you accept their invitation and give your consent. Coinfig does not send your transaction history or tax reports to SARS, except if required by law or valid legal process. The privacy notice sets out the rest, including your rights under POPIA.
Read-only keys. Addresses, never phrases. Your consent first.