Do not trust us. Check.
BTCPay Server’s own documentation warns that a third-party host can run a modified version and redirect payments to itself. That warning is correct, and it applies to us.
We cannot answer it by promising to be honest. We can answer it by telling you exactly what we run, so you can compare it against the official releases — and by building the product so that even a dishonest version of us could not take your money.
What we run
Unmodified upstream images, identified by content digest. A digest cannot be faked: it is derived from the image contents, so it either matches the official release or it does not.
BTCPay Server 2.4.4
Official source ↗The payment engine. Creates invoices, derives addresses from your key, and watches the chain for payment.
- Image
- btcpayserver/btcpayserver:2.4.4
- Digest
- sha256:c264aa08cd32a469bd30d41978b73dc8bb2de1503ce67bdb0ab8fd5d934fb614
NBXplorer 2.6.17
Official source ↗The indexer. Scans blocks for addresses derived from your extended public key. Never sees a private key, because none exists here.
- Image
- nicolasdorier/nbxplorer:2.6.17
- Digest
- sha256:c2c6e9de0dfdd9ec7ebe49c59ee7e654fd634e8211cd5e2c6c0af6ffe6d77a1f
Bitcoin Core 31.1
Official source ↗Our own full node, pruned. We verify the chain ourselves rather than asking a third party what happened.
- Image
- btcpayserver/bitcoin:31.1-1
- Digest
- sha256:b7fe7d0c6a0db6114d29921644bd1be8fc0efbc4abef04b1caf2242cc416c31d
Last verified against the running server on 2026-09-21.
How to check it yourself
Two independent checks. Neither requires taking our word for anything.
1. Verify the images
Pull the same digest from Docker Hub and confirm it is the official release. If our digest matches what upstream publishes, the code we run is the code they wrote.
docker pull btcpayserver/btcpayserver:2.4.4
docker image inspect btcpayserver/btcpayserver:2.4.4 \
--format '{{index .RepoDigests 0}}'2. Verify your own payments
This one is stronger, and it does not depend on us at all. Your payments settle to addresses derived from your extended public key. Open your own wallet, or a block explorer, and look.
If a payment is in your wallet, it is yours, whatever we say or do. If it is not, no dashboard of ours can invent it.
What we can see
- Your email address, and the business name you typed at signup.
- Invoice metadata: amounts, timestamps, which currency was used, and whether an invoice settled.
- Your extended public key, and the addresses derived from it — the same information anyone can read off the blockchain once a payment is made.
What we cannot
- Your private keys or seed phrase. We never ask for one, and there is nowhere in the product to enter one.
- Your funds. Payments go from your customer to an address derived from your own key. They never pass through an account we control.
- Your customers' identities. We do not run KYC on you or on them.
What happens if we disappear
Nothing happens to your money, because we never had it. Every payment you have received is already in your wallet and remains spendable with your own keys, whether this company exists tomorrow or not.
You would lose the dashboard, and need another way to generate invoices. The engine is open source and free to self-host, so that is an afternoon of work, not a loss.
This is the whole difference between self-custody and a custodial processor, and it is not a marketing distinction. It is the difference between an inconvenience and an insolvency.
Two rules that do not bend
- We never accept, store, or transmit a private key or seed phrase. Not in a form, not in support, not temporarily. There is no field for one anywhere in the product. If anyone claiming to be us asks you for one, they are stealing from you.
- We never modify BTCPay Server. Every release is a plain upgrade of the upstream image. Patching it would mean inheriting its maintenance forever and losing the security review of a project far larger than us — and it would make the digests above meaningless.