Skip to content

security and risk

Two different questions, answered separately.

Whether somebody can take this from you is a security question, and controls answer it. Whether it can go wrong on its own is a risk question, and only arithmetic answers that one. Mixing them lets the comfortable half carry the uncomfortable half.

security

No badges we don't hold.

Every protection listed here names the file it traces to, so you can check any single line by opening that file. What is not listed is not claimed.

Your account and your wallet

  • Server-side EIP-191 ownership verification
    api/app/core/security.py

    To bind a wallet you sign a challenge, and the backend recovers the signer with EIP-191 and checks it matches the claimed address. The browser is never trusted to assert ownership.

  • A health-factor guardrail on every authorization
    lib/engine/ltv.ts

    A charge is declined if it would leave locked holdings worth less than 1.25x of what has been drawn. The same check runs on a coffee and on a flight.

  • Card controls that are yours
    components/app/CardManager.tsx

    Freeze and replace the card, set a spend limit, and allow or block online and international purchases from the account itself.

This site holds nothing worth stealing

  • Server-side calls only
    lib/server/csp.ts

    The browser talks to this site alone; the Content-Security-Policy pins connect-src to self. Backend hosts and keys exist only server-side, never in a client bundle.

  • Inline scripts blocked where you sign in
    lib/server/csp.ts, scripts/check-csp.mjs

    Every signed-in page, the sign-in and sign-up screens, and every API route carry a fresh per-request nonce, so no injected inline script can run there. These public pages are prerendered once and still permit inline script; styles do site-wide, because the stylesheet is inlined for load speed. CI checks the served header against the served markup on every commit.

  • Strict headers, no trackers
    next.config.ts, tests/no-trackers.test.ts

    X-Frame-Options DENY, nosniff, strict referrer policy, HSTS in production. Zero third-party analytics or tracking scripts, enforced by CI.

  • Validated endpoints
    lib/server/ratelimit.ts, app/api/waitlist/route.ts

    The waitlist form is validated server-side, and a bad address is refused before anything is stored.

What we do not claim

No compliance certifications: no SOC 2, no PCI attestation. No insurance, and nothing "bank-grade". gether is not a bank, and we show no badges we do not hold. Every claim above names the file it traces to; the drafted legal terms live under /legal. Reach us any time at /support.

financial risk

What can go wrong when nobody has done anything wrong.

These are not edge cases. They are the ordinary behaviour of an account whose ceiling is derived from prices that move.

Prices move, and your spending power moves with them

The ceiling is derived from what your locked positions are worth right now. When they fall, it falls, and it can fall below what you have already drawn.

View the mechanics

Spending power is recalculated from current prices, not fixed at signup. That is what makes it useful when positions rise, and it is the same mechanism that reduces it when they fall. There is no floor under it.

If the ceiling falls below the drawn balance, availability is zero: charges are declined until the balance is repaid or more collateral is locked.

A drawn balance costs money and has to be repaid

Carry accrues on what you have drawn until it is repaid. Repayment is an obligation, not an option, and it does not go away if the market goes the wrong way.

View the mechanics

The disclosure figure for carry is published on the plans page, and the rate on a given account is set on that account. It accrues on the outstanding balance, so a balance carried longer costs more.

Repayment is owed whatever happens to the positions. A fall in the market reduces what the account can support and does not reduce what has already been drawn.

There is a maintenance requirement, and it is enforced

Locked collateral has to stay above 1.25 times the drawn balance. Below 1.5 the account is in Watch. At 1.25 charges are declined.

View the mechanics

Account health is eligible collateral divided by the drawn balance, and the guardrail is checked on every authorization rather than on a statement cycle. The bands are informational until the guardrail, which is where the account stops spending.

Restoring headroom is done by repaying part of the balance or by locking more of what you hold. Both work immediately.

Holdings can be sold to settle what you have drawn

If the account reaches the guardrail and stays there, positions can be sold to bring the balance back inside it. This is the outcome the whole guardrail exists to avoid.

View the mechanics

A sale made this way is a real sale at market prices. It ends the exposure you were keeping, realises whatever gain or loss the position carries at that moment, and happens on the market's timing rather than on yours.

The order in which positions would be sold, and the notice given before it, are governed by the account agreement. Read it before you draw.

Eligibility and rates are not fixed

Which assets can be locked, and the rate each counts at, are set by the collateral catalog and can change. An asset accepted today may not be accepted tomorrow.

View the mechanics

A change to a rate changes the ceiling on every account holding that asset. A change to eligibility can remove an asset from the ceiling entirely. Neither requires your agreement, and both are subject to the account agreement's notice terms.

There are tax consequences, and we are not the ones to explain them

Spending does not sell, so it does not itself realise a gain. A forced sale does. How either is treated depends on you.

View the mechanics

Nothing on this site is tax advice, and nothing on it is written by anyone qualified to give it. If any part of this matters to your position, that is a question for a tax professional before you draw, not after.

No performance is promised, by anyone, ever

Keeping a position means keeping its downside. gether does not change what your holdings do; it changes what you can do while holding them.

View the mechanics

The argument for spending this way is that it does not force an exit. It is not that holding is better than selling, and it is not that markets recover. Nothing on this site claims either.

see how account health works

Do it to an account rather than reading about it.

This is the example account used across the site. Move the market and watch the cushion close, and read the exact fall at which each state is reached.

0%
Portfolio
$84,250
Available to spend
$18,400
Drawn balance
$29,555
Eligible collateral
$73,810
In use
62%
Comfortable cushion
2.50x cover
Guardrail 1.25xWatch 1.5x1.0x to 3.0x and above

Locked collateral is comfortably above the drawn balance. Nothing to do.

Cushion starts thinning
-42%

Below this the account is in Watch. Nothing is sold, but the gap has narrowed.

Guardrail at 1.25x
-53%

New charges are declined from here, and holdings can be sold to settle the drawn balance.

A market move is applied to the priced positions and not to the cash lane, which is why an account holding cash falls further before it reaches either line. The falls quoted are for this example account at this drawn balance; a different balance moves both.

Figures on this page describe one example account at the reference prices the pricing engine carries. They are an illustration of how the account works, not an offer, a quote, or anyone's balance.

Read it before you need it.

The account agreement carries the terms behind everything on this page, and it is linked from every footer on this site.