Your money is safe, and so is your family’s.
How Casa protects you, how to spot a scam, and what to do if something looks wrong.
How Casa protects you
Casa never holds your money
Your balance lives in your own account with Whop and its financial partners. Not with Casa, and not on your phone.
Your card number never touches Casa
Card numbers, bank details and identity documents stay inside Whop’s own secure screens. Casa’s servers never receive them.
We never see your password
You sign in with Whop. Casa never sees your password, and each sign-in is bound to the device that started it, so an intercepted link is useless to anyone else.
Your session stays locked
Casa keeps you signed in with an encrypted session: in your phone’s secure keychain in the app, or in a secure cookie the page’s scripts can’t read on the web. Signing out deletes it.
Nothing sends twice
You see the amount and the fee before you confirm. Each send carries a one-time key, so if the connection drops and you try again, the money still moves once.
Invites are private and expire
A family invite link is for one person and expires after a few days. Casa keeps only a scrambled copy of its code, and you both confirm before you’re connected.
How to spot a scam
Scammers pretend to be companies and family. Knowing what Casa will never do is the best protection.
Casa will never
- Ask for your password, verification codes or full card number
- Ask you to send money to “verify”, “unlock” or “protect” your account
- Email you from an address that doesn’t end in @casa.family
- Ask you to install another app or share your screen
Red flags
A relative needs money urgently, from a new number
Call them on the number you already know before you send anything.
Someone offers to set up Casa for you
Set it up yourself. Nobody else needs your phone, your codes or your ID.
A message rushes you
Real problems can wait five minutes. Pressure to act now is the scam.
If something looks wrong
- 1
Stop
Don’t send more money and don’t share any codes, even if the person seems official.
- 2
Secure your account
You sign in to Casa with Whop. Change your Whop password from a device you trust. Whop help can help you secure it or get back in.
- 3
Tell us
Write to hola@casa.family with what happened and when. If someone is pretending to be Casa, send us their number or address so we can warn others.
Found a vulnerability? Tell us.
If you’ve found a security problem in casa.family, its API or the Casa app, we want to hear about it, and we’ll work with you to fix it.
Report to hola@casa.familyWhat to send
- “Security” in the subject line
- What you found and where
- Steps to reproduce it, and the impact
What we promise
- We’ll confirm we got your report within 3 business days and keep you posted until it’s fixed.
- If you follow these rules in good faith, we won’t take legal action against you for your research.
- We’ll credit you when it’s fixed, if you’d like. We don’t run a paid bounty yet.
The rules
- Test only with accounts you own. Never access, change or delete anyone else’s data.
- No denial of service, spam, bulk sign-ups or social engineering of people.
- Give us a reasonable time to fix it before you tell anyone else.
Whop runs accounts, balances, cards and identity checks. Report problems in Whop’s own systems to Whop. Our security.txt has these details in machine-readable form.