Paid in Sats is software, not a bank. Your money moves from your customer's wallet to yours in one motion; it is never parked with us, and this page explains why that is true by construction, not marketing.
That round trip through the mint is what makes the rest work: the mint confirms the payment for us, so you can be paid at any Lightning wallet without running anything yourself, and its blinded ecash means nobody learns who your customer is.
Our fee is carved out inside that same payout as ecash locked to a key that only exists offline, outside the server. The remainder, which is everything your customer paid minus the fee and network costs, lands in your wallet directly.
The server keeps records: what was paid, when, for what reference, and what it was worth in your reporting currency. It holds nothing spendable at rest. Even someone who stole the entire server could read those records but could not move a single sat: your funds are in your wallet, and our own fee sits locked to an offline key.
The one nuance worth stating plainly: a customer paying from a Cashu wallet submits ecash instead of paying the mint's invoice. That ecash is redeemed at the mint for your payout within seconds; it is staged in between only so a crash cannot lose a payment, and there is never a balance with us.
Put another way: Paid in Sats provides software and record-keeping. The mint is operated independently, and your Lightning wallet is your own. At no point in a payment do we hold, control or have any claim on the money.
For the few seconds a payment is in flight, a Cashu mint carries the value: your customer's payment is minted into ecash and immediately melted, that is, paid out over Lightning to your address.
That pass through blinded ecash is also what makes the payment private: the mint has no accounts and no idea who either of you is, and we only ever see the record, not the money.
So the moving parts a payment relies on are the mint, for moments at a time, and your own Lightning wallet being reachable. If anything fails part-way, a recovery loop retries until the payment completes; a customer whose payment cannot start simply sees it fail in their wallet before any money moves.
There is no email, no password and no identity check. Creating an account generates twelve words in your browser; they never reach us, and the server only ever sees a public key derived from them. That is also the honest cost of this design: lose the words and there is no reset, no recovery and no support ticket that can help. Write them down.
1% per payment, capped at roughly $25 in a calendar month; past that your payments are free. The cap applies as each payment is created, so a burst of simultaneous payments can finish the month a touch over it. Your customer always pays the sticker price: the fee comes out of the payout, never on top. There are no signup, monthly or hidden fees.
Because your money never sits with us, there is nothing for us to claw back. A refund is simply you paying your customer, eg to their Lightning address, like any other payment. That is a policy worth stating plainly: no processor sitting between you and your customer also means no processor who can reverse, freeze or "hold for review" your money.
Payment records for your history and books, and the settings you choose: your payout Lightning address, a display name, and any notification, webhook or API options you turn on. No card numbers, no postal addresses, no identity documents, because we never ask for any.
The code that touches money runs in your customer's browser, where anyone can read it: open the developer tools on any pay page and the settlement logic is right there. The pattern has form, too: the same author's Cashu for WooCommerce and cashu-vpn settle browser-side the same way, in public repositories.
Paid in Sats is built on the open Cashu protocol. Read about Cashu at cashu.space, or build with it yourself using cashu-ts, the TypeScript library this service runs on.