Security & data handling
Security & Data Handling
How we receive, protect, use, retain and delete case information, wallet files and recovery material.
This page explains the operational safeguards from first contact through secure transfer, controlled technical work, handover, retention and deletion. To independently verify our company details and recognize impersonation, use the Trust Center. The privacy policy separately explains the purposes and legal bases for processing personal data.
Safe first contact
What is safe to share, and what we will never request up front.
What we will never request through an ordinary contact form
Seed phrases, private keys, wallet passwords, wallet files, raw backups or identity documents. First contact needs none of this.
When confidential material may be requested
Only after a written agreement is in place and identity, ownership or legal authority has been verified. The material, the purpose and the secure transfer method are agreed per case. Even then, we work with copies where possible and never ask you to send secrets through unsecured channels.
Agreement and authority
The written, authorized and non-custodial framework for a case.
For the complete sequence from first contact to handover, see How Crypto Wallet Recovery Works.
Agreement process
Scope, fee, confidentiality and security arrangements are agreed in writing before any work. On request we sign an NDA first. The success fee is agreed in advance: no recovery, no fee, and no advance without a written agreement and a stated quote.
Ownership and authority verification
We verify identity and evidence of wallet ownership, and verify legal authority for heirs, executors and authorized representatives, with risk-based KYC and AML checks. We do not work on wallets that are not provably yours to access.
Non-custodial workflow
We rebuild access; you open the wallet and move the funds yourself. We do not receive, hold or move your assets on your behalf. Any technical access to sensitive wallet material is limited to the agreed recovery work.
Secure transfer and communication
How case material moves from first contact to deletion.
Sensitive material moves only through the method agreed for the case. For encrypted email and fingerprint checks, use our PGP public key.
Secure transfer, agreed per case
The transfer method is agreed in writing for each case: encrypted email (PGP), encrypted upload, or in-person handover at our Amsterdam office or another agreed location. The method fits the material and the case.
Secure communication
For anything sensitive, use encrypted email. Our PGP public key, fingerprint and verification instructions are on the PGP page. Always confirm the fingerprint through a second channel - never trust a key that only arrives by email.
Public policy vs. confidential procedures
Everything below is public policy: the commitments you can hold us to. The internal procedures that implement them - tooling, key handling, environment configuration - are confidential and are not published.
Controls during the work
Practical safeguards applied to the material being worked on.
Controlled recovery environment
Where applicable, recovery work runs on copies of your files in a controlled, offline environment with limited, logged access.
Controlled access
Access to case material is limited to the named specialists assigned to the case and to what the technical work requires.
Minimal-access principle
Only the material reasonably necessary for the agreed recovery is requested, used or retained. When a partial approach is possible, the full seed phrase is not requested.
Copies and work copies
We work with copies where possible; the client's original stays untouched. Work copies are treated as sensitive material and covered by the same retention and deletion commitments.
Chain of custody, where applicable
For cases that may involve legal proceedings - inheritance, disputes, court matters - handling is documented so the material's path can be accounted for. This is applied where applicable, not claimed as universal.
Closure and accountability
Return, retention, deletion and escalation after the technical work.
Retention of personal data and communication records is explained in the privacy policy.
Retention
Wallet recovery data and temporary credentials are retained only as long as necessary for the agreed assignment. Account and communication records are covered by the privacy policy's retention periods.
Deletion and return
Recovery data is deleted immediately after recovery completion. Encrypted backups may retain residual fragments for up to 30 days, after which they are automatically purged. Your original material is returned or confirmed destroyed as agreed in writing. Documented in privacy policy.
Client-controlled handover
After a successful recovery, access is handed back through the agreed secure process. You move the funds yourself to a wallet you created; we never take custody of your assets.
Incident and escalation contact
If you believe material was mishandled, or you need to escalate, contact security@cryptorecovers.com for security matters or support@cryptorecovers.com for case matters. We will acknowledge and investigate.
Contact
Start with a description, not your secrets.
Tell us what happened and what material still exists. The first assessment is free and does not require sensitive wallet data.