Security
How your Bitcoin
is actually handled.
No vague reassurances — here's exactly what Hindex can and can't do with your deposit, and why.
01
Where your deposit address comes from
Every investment gets its own fresh Bitcoin address, derived from a single extended public key (xpub). An xpub can generate addresses and watch them for incoming payments — but it cannot sign a transaction. The private keys that could actually spend those funds are kept offline, entirely separate from the web application, database, and servers that run Hindex.
02
What that means if the server is compromised
Because the application only ever holds a watch-only key, a breach of the web server, database, or codebase does not by itself expose a way to move already-received Bitcoin. It could expose account data (see below) — it cannot sign a withdrawal.
03
How deposits are confirmed
Hindex watches the real Bitcoin network for your transaction via an Electrum server connection — the same lightweight protocol used by Electrum wallets. An investment only activates once your deposit reaches the plan's required confirmation count. There's no override, no manual "mark as paid" — just the blockchain, observed honestly.
04
How withdrawals work
Hindex doesn't auto-sign outbound Bitcoin transactions — it can't, for the same reason described above. A withdrawal request is logged and handled manually, outside the web application, using keys that never touch this codebase.
05
What data we actually collect
An account needs a username, an email address, and a password (stored as a salted hash, never in plain text). That's it. Hindex never asks for ID documents, card numbers, or bank details — there's nothing here to collect them for.
06
Transport & infrastructure
Every connection to Hindex is served over HTTPS/TLS. Session and CSRF cookies are scoped to secure connections in production, and the database, cache, and background workers run as isolated, non-public services behind the web layer — not exposed directly to the internet.
If Hindex went offline tomorrow
Hindex is an educational project, not a licensed custodian or company with continuity guarantees. We're upfront about that on every page. It exists to show, transparently, how a fixed-term Bitcoin yield product works under the hood — not to hold your funds long-term or replace a real financial service.
Found a vulnerability?
This is a small, independently run project without a formal bug bounty program. If you find a security issue, responsible disclosure is genuinely appreciated — please report it privately and give us a reasonable chance to fix it before discussing it publicly, rather than testing destructively against the live site.