Security

Security Built Into Every Layer

Your keys never leave your device. Your funds are never held by us. Here's how Scion Wallet protects what's yours — and how to protect it yourself.

Security by Design, Not by Promise

Scion Wallet is built so that we never can access your funds — not that we simply choose not to.

Local Encryption

Private keys and seed phrases are generated and encrypted locally inside the extension. They're never sent to our servers — we have no copy, no backup, and no way to retrieve them.

Encrypted at Rest

Everything stored by the extension — keys, seed phrases, account details, saved networks — is encrypted with industry-standard algorithms before it touches your browser's storage.

Isolated Operations

Signing a transaction or unlocking your wallet happens inside a protected service worker that web pages and browser tabs cannot reach. Malicious sites cannot touch your keys.

OTP on Every Login

A one-time code sent to your email is required for every login and again before certain transfers. This cannot be turned off.

Auto-Lock Sessions

If you step away, your wallet locks itself after a set period and clears its decryption key from memory. It cannot be unlocked without your password.

Non-Custodial by Default

Even during the 24-hour hold on a Normal Transfer, your money sits in a public smart contract — not with Scion. We cannot redirect it except back to you.

Your Keys, Your Responsibility, Your Control

Your private keys are the ultimate authority over your funds. Never share them with anyone — including Scion support staff, who will never ask for them under any circumstance.

Private keys are generated and stored locally on your device. Scion never has access to them, never stores a copy, and cannot recover them for you.

Your seed phrase is your ultimate backup. Write it down on paper and store it in a secure offline location — never in a screenshot, cloud note, email, or messaging app.

Seed Phrase Best Practices

Never Digitize

Store your seed phrase on paper only. No screenshots, cloud storage, or digital copies.

Separate Location

Keep your seed phrase in a different physical location from your device — a safe deposit box or secure vault is ideal.

Recover Anywhere

Lost your device? Import your seed phrase into the extension on a new device to restore full access.

No Recovery Without It

Without your seed phrase, the wallet cannot be recovered by anyone, including Scion.

Two Passwords, Two Different Jobs

Scion Wallet involves two separate credentials. Understanding what each one protects is critical.

Website Password

Controls access to your website account — authentication, subscription management, and enterprise dashboard access. This password can be reset through normal account recovery.

Handles authentication only — never touches your wallet vault

Extension(App) Password

Encrypts your local wallet vault. It never leaves your device and cannot be reset by Scion. If you have your seed phrase, you can always recover. Without it, the vault cannot be unlocked.

Never leaves your device — Scion cannot reset or recover it

Your Device Is Your Vault

The security of your wallet depends on the security of the device it runs on.

Keep Software Updated

Always run the latest operating system and browser versions to protect against known vulnerabilities.

Use Anti-Malware

Install reputable antivirus and anti-malware software on any device that accesses your wallet.

Avoid Public Wi-Fi

Public networks are vulnerable to attacks. Use a VPN if you must access your wallet on an untrusted network.

Lock Your Device

Set a strong PIN or biometric authentication on your device so it is protected even when unattended.

Enable Auto-Lock

Configure the wallet's auto-lock timer in Settings so an unattended session locks itself automatically.

Be Aware of Shoulder Surfing

Be mindful of your surroundings when entering passwords or viewing sensitive wallet information in public.

Verify Before You Trust

Phishing and social engineering are the most common threats. A moment of verification can prevent a lifetime of regret.

Check the Domain

Always confirm you're on the official scion.digital domain before entering credentials. Check the URL for subtle lookalike characters.

Scion Never Asks for Secrets

We will never ask for your password, seed phrase, or one-time code via email, chat, or phone. Treat any such request as fraudulent.

Beware of Urgency

Messages claiming your account will be suspended or funds at risk unless you act immediately are a common manipulation tactic. Stop and verify.

Double-Check the Address

Always verify the recipient address before confirming a transaction. EVM addresses are case-sensitive — a single wrong character can be costly.

Use Normal Transfer for Large Amounts

For new counterparties or significant sums, use Normal Transfer. The 24-hour window gives you time to cancel if something looks wrong.

Test with a Small Amount First

Send a tiny test transaction to confirm the address is correct before transferring the full amount. This costs little but prevents catastrophic errors.

Enterprise Visibility Stops at the Wallet's Edge

For organizations using the enterprise subscription model, the separation between user identity and wallet data is structural.

What Enterprise Admins Can See

User names and email addresses
Invitation and account status
Active/inactive user counts
Subscription status and expiry

What Enterprise Admins Cannot See

Wallet addresses or private keys
Seed phrases or recovery phrases
Transaction history
Wallet balances or blockchain credentials

Built-In Recovery Paths, Even in Failure

Scion Wallet is designed so that common problems have a clear resolution path.

Lost or Stolen Device

Your funds are safe as long as your seed phrase is secure. Import it into the extension on a new device to restore full access.

Forgotten Extension Password

Scion cannot reset this. Recovery requires your seed phrase — this is a deliberate trade-off of non-custodial design.

Suspicious Account Activity

Change your scion.digital password immediately and contact support through official channels only.

Contract Paused in Emergency

If the smart contract is paused, pending funds are automatically returned to the original senders. Your funds are never permanently locked.

Extension Uninstalled

All locally stored wallet data is permanently deleted. This is not backed up by Scion. Always confirm your seed phrase is backed up first.

Non-Custodial Reminder

There is no central authority that can recover lost funds, reverse a Secure Transfer, or reset your extension password.

Behind the Scenes

Technical Specifications

A high-level look at the technology protecting your wallet. Designed for transparency — no jargon, no black boxes.

Local Encryption

Your wallet data is encrypted and locked on your device before anything is saved to your browser. We never see your keys.

Service Worker Isolation

Your keys live in a protected zone that websites cannot reach — even on a malicious page, your wallet stays safe.

Rate Limiting & Security Checks

The extension automatically limits requests and validates every action. Only approved operations are allowed — blocking abuse before it starts.

Non-Custodial & Secure Connection

Your private keys never leave your device. The only data sent to our servers is anonymous and non-identifying, always over HTTPS.

Smart Contract Security

Built with OpenZeppelin safety standards — reentrancy protection, safe ownership control, emergency pause, and publicly verified source code.

For the full technical deep dive, the contract source code is publicly verified on every supported blockchain explorer.

Questions About Security?

Our support team can help with account and platform questions — though remember, we can never see or recover your keys.