Read-only by design
PONSUM reads public chain data. An address you paste gives it nothing it could spend, and it never asks for keys or seed phrases.
Security
PONSUM is built so there is as little as possible to protect: no accounts, no keys and no deposits.
No accounts to breach
There are no sign ups, passwords or email addresses to store, so there is no account database to leak.
Proof on Robinhood Chain
Report IDs are anchored onchain, so anyone can check later that a report has not changed.
Adding a wallet by address only reads what is already public on Robinhood Chain: transfers, swaps, balances and receipts. PONSUM cannot move anything from an address you paste.
Connecting a wallet is optional. It identifies the workspace owner and lets you sign the transactions you choose. Plans are paid in ETH, so PONSUM never needs you to approve token spending.
PONSUM finds browser wallets through EIP-6963 and asks to add or switch to Robinhood Chain when it needs to. Every transaction and signature opens in your wallet first, where you can read it and reject it.
The only signature PONSUM asks for is a typed EIP-712 message that consents to linking a wallet to a workspace. It names both addresses and carries a deadline after which it can no longer be used.
There is nothing to sign up for. PONSUM does not collect names, email addresses or passwords. Nobody from PONSUM will ever ask you for a private key, a seed phrase or remote access to your device, and any message that does is not from us.
Your workspace is stored in your browser's IndexedDB: wallet addresses and labels, sync progress, cached transactions and prices, and any categories, prices or notes you changed. A few preferences, such as your country and whether you dismissed the announcement bar, are kept in localStorage.
You can export the workspace as a file at any time, and clear it from Settings or from your browser. Clearing it on one device does not affect anything onchain.
The public Robinhood Chain endpoint does not accept requests from browsers, so the site reads through its own endpoint at /api/rpc. It forwards a fixed list of read methods, such as blocks, logs, receipts, balances and contract calls, keeps batches small, and refuses everything else, including every method that could send a transaction.
Transactions you sign never pass through the proxy. Your wallet sends them to the network through its own connection.
Anchoring writes a report ID to the PONSUM registry together with the tax year, country, method, transaction count, a hash of the report's wallets and the workspace it belongs to. Anyone can check an ID on Verify a report. A dropped report file is recomputed in the browser and only counts as a match when every anchored detail agrees with the file.
Onchain records are public and permanent. Anchor only the reports you are comfortable linking to your workspace address.
The PONSUM registry records plans, wallet links, accountant grants and report anchors. It holds plan payments until they are withdrawn to the treasury and never holds your tokens. Plain ETH sent to it without a plan purchase is rejected, and handing over ownership of the contract takes two separate steps.
The site is a set of static files and one read-only function, hosted on Vercel and served over HTTPS. Pages are sent with strict security headers and cannot be embedded in other sites. Like most hosts, Vercel keeps standard request logs, such as IP addresses and browser details. The privacy policy has more.
Found a security issue? Send a direct message to @ponsumapp on X that starts with the word Security, with the page or contract involved and the steps to reproduce it. Please never include private keys, seed phrases or personal data.
Any questions?
Security questions deserve straight answers. Send a direct message on X and we will reply there.