SatsRail is a non-custodial payment rail. We process payment data only — not content, not identity. Most people hear that and think about privacy. But this separation has deeper implications — for the merchant, the customer, and for us.
What “Non-Custodial” Actually Means
When we say SatsRail is non-custodial, we mean the architecture separates payment processing from content. SatsRail handles invoices and confirmations. Content lives elsewhere.
Here is what SatsRail sees:
- Invoice amounts and order records
- Payment confirmations
- Lightning addresses (the merchant’s destination)
Here is what SatsRail does not see:
- What the merchant sells
- Who the buyer is
- What the buyer purchased
- What the decryption key unlocks
- Whether the buyer ever comes back
The gap between those two lists is the privacy. It’s not a feature we built — it’s a consequence of what we left out.
What This Means for the Customer
SatsRail does not require merchants to collect customer identity. No email. No account. No profile. Privacy for the customer is the default — the merchant chooses whether to change that.
The customer’s interaction with SatsRail is a Lightning payment — and that payment is peer-to-peer. Sats flow from the customer’s wallet directly to the merchant’s wallet. SatsRail confirms the invoice was paid and delivers a decryption key. That’s the entire relationship.
We record orders and payment confirmations — that’s the merchant’s transaction data. But we don’t require the merchant to attach a customer identity to those records. The decryption key is the receipt — and it lives on the customer’s device, not on our servers.
If someone asks us who bought what, the honest answer is: we don’t have that data. Not because we deleted it. Because we never required it.
What This Means for the Merchant
Full sovereignty. Over content, over pricing, over customer relationships.
SatsRail processes payments — content decisions are the merchant’s. There is no content moderation team at the payment layer. There is no appeals process for what you sell. Because the payment infrastructure is separate from the content.
The merchant’s Lightning address is a destination, not an account we control. We don’t hold funds. We don’t escrow. We don’t have a “pause payouts” button. The money moves the moment the customer pays — and it lands in the merchant’s wallet, not ours.
Your content, your pricing, your customers. The payment rail serves the merchant — it doesn’t judge the merchandise.
The Cost of Separation
Here is the honest part.
If you can’t see what moves through you, you have to be right every time. There is no manual review. No human override. No “let me check that transaction.” The system either works or it doesn’t — and there is no one to call when it doesn’t.
This is the trade-off of a non-custodial architecture. You get privacy by minimizing data collection. You get merchant control by separating payment from content. And the infrastructure has to earn that trust through engineering, not through oversight.
Every invoice must resolve. Every webhook must fire. Every key must deliver. Every payment confirmation must be correct. Not most of the time. Every time.
That is what we are building. Not a privacy feature. Not a marketing position. A system that is reliable enough to be trusted without being watched.
Minimal Data Footprint
SatsRail stores what it needs to process payments: invoice amounts, order records, payment confirmations, and Lightning addresses. That’s it.
No customer identity is collected. No content is stored on our servers. No funds are held in custody.
This matters because privacy policies change. Companies get acquired. Data requirements shift. The strongest privacy guarantee is architectural — you cannot hand over what you never collected. You cannot update a policy to start collecting data your system was never designed to store.
This isn’t a privacy policy that can be revised. It’s a data-minimization architecture built into the system from day one.
SatsRail is non-custodial Bitcoin payment infrastructure for merchants. We built payment infrastructure with a minimal data footprint — processing payment data only, with no content visibility and no buyer identity collected. Learn how it works.