🛡️ Sign In to GhostVault
Enter your credentials to access your merchant dashboard
Invalid username or password.
No account? Subscribe to activate your merchant account
Choose your plan, then enter your name/company and email. You'll see the payment QR — pay first, then your User ID and password setup will unlock.
Select Your Plan
✅ This name will appear on your merchant profile
➕ Add New User
Create a login for a new GhostVault user
📤 Share Secure Payment QR
Share this QR with your customer. Timed QRs stop at the server when they expire or are revoked.

Merchant identity: —

Control the QR.
Even After You Share It.

GhostVault creates a server-controlled payment link instead of putting your raw UPI ID inside the QR. Timed sessions can really expire or be revoked, while Smart QR lets you update the destination later without reprinting the physical code.

Tokenizedraw UPI not stored in public QR
Dynamicserver-controlled QR sessions
🔒 MaskedUPI ID not embedded in QR
Server TTLsaved QR can truly expire
🛡️ Dynamic Payment Session Control
🎁 Free Trial
0 / 2 free QR codes used
1
2
3
🔒 Stored server-side for payment handoff — never embedded in the QR
Optional compatibility hint. The final UPI app resolves the beneficiary from the UPI ID and may show the bank-registered name.
🎭 Customers see a GhostPay alias + generated GhostPay ID on the GhostVault page, not your raw UPI ID
Already have an account? Sign In
THE MECHANISM

How GhostVault Works

🏪

Create a Server-Controlled Link

Your UPI destination is stored behind GhostVault. The QR itself contains only a random GhostVault payment token.

→
📲

GhostVault Validates the Scan

Every scan checks status and expiry on the server, then shows merchant, amount and purpose before UPI is opened.

→
✅

Choose Settlement

Use Direct Merchant Pay for direct UPI settlement, or GhostPay Balance for a provider/acquirer-backed merchant balance with withdrawals.

CONTROL LAYER

What GhostVault Actually Controls

📸

Saved QR Reuse

A saved QR contains only a GhostVault token. After server expiry or revoke, that saved token no longer hands off to UPI.

CONTROLLED
🔗

Forwarded Payment Links

Forwarded GhostVault links are checked server-side on every scan and can be revoked by the merchant.

REVOCABLE
🎭

Public UPI Exposure

The GhostVault QR/page shows a GhostPay alias and ID instead of embedding the raw UPI ID. The final UPI app can still show the bank-resolved beneficiary identity.

MINIMIZED
⏱️

Timed Access

Timed links stop handing off to UPI after their server TTL. Smart QR links remain active until the merchant revokes them.

ENFORCED
💸

Balance Payment Idempotency

GhostPay Balance uses unique payment intents and provider-confirmed ledger credits. Direct UPI app-open is not treated as payment success.

TRACKED
⚠️

Physical QR Replacement

No web app can detect when an attacker physically replaces your sticker with a different QR. Customers should verify the GhostVault domain and final UPI recipient before paying.

USER CHECK