# BTCPay Server review: KYC policy, privacy and safety grades

> BTCPay Server is a payment gateway operating since 2017. Its terms put it at KYC level 0 of 4: ID never required. NoKYC Score grades it 8.9/10 for privacy (excellent) and 6.8/10 for safety (fair). In its favour: no account needed, no email needed and no phone number. One incident is on record, the latest from 7 Aug 2026.

Source: NoKYC Score, "BTCPay Server review", reviewed 22 Oct 2026, https://nokycscore.com/service/btcpay-server

## Key facts
- **Category:** Payment Gateways
- **KYC level:** 0 of 4: ID never required
- **Grades:** Privacy 8.9/10, Safety 6.8/10
- **Sign-up:** No account needed
- **Custody:** non-custodial
- **Fees:** 0% processing fees; hosting costs only
- **Jurisdiction:** Decentralised / none
- **Incidents on record:** 1
- **Last reviewed:** 22 Oct 2026
- **Official website:** https://btcpayserver.org

## What it is
BTCPay Server is a self-hosted, open-source cryptocurrency payment processor that lets merchants accept Bitcoin, including over Lightning, directly into wallets they control, with no processing fees and no intermediary. The site stresses that it is an open-source project and not a company, so there is no operator that could onboard or verify merchants. On 7 August 2026 the project published a security advisory urging all operators to update to version 2.4.2 because a flaw allowed an unauthenticated attacker to obtain LND Lightning node credentials; the flaw was exploited against several merchants before they patched.

## What the terms say about ID
Self-hosted software with no operator; the site states it is "an open-source project, not a company".

## Features and warnings
- **Identity:** ID never required: yes; No account needed: yes; No email needed: yes; No phone number: yes
- **Payment:** Accepts Monero: yes; Accepts Lightning: yes
- **Access:** Tor onion address: not stated; Works without JavaScript: not stated
- **Trust:** Never holds your funds: yes; Open source: yes; Independent audit: not stated; Company named: not stated; 5+ years operating: yes
- **Warnings:** May ask for ID: not in terms; Screens deposits: not in terms; Holds your funds: not in terms; Email required: not in terms; Phone number required: not in terms; Closed source: not in terms; Nobody accountable: not in terms

## Incidents on record
- 7 Aug 2026: Security advisory: flaw exposing LND credentials exploited before version 2.4.2 (outcome: unknown). Source: https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/

## Questions
### Does BTCPay Server require KYC?
BTCPay Server is rated KYC level 0 of 4 on this site: ID never required. Self-hosted software with no operator; the site states it is "an open-source project, not a company".

### Is BTCPay Server safe to use?
BTCPay Server has a Safety grade of 6.8 out of 10 and a Privacy grade of 8.9 out of 10. There is 1 incident on record, listed with sources on this page. Evidence level: documentation reviewed.

### Is BTCPay Server legit?
BTCPay Server is a working payment gateway that has operated since 2017. Being real is not the same as being safe: its Safety grade here is 6.8 out of 10, built from custody, liquidity, track record and incidents.

### Is BTCPay Server a scam?
NoKYC Score does not label services as scams; it records documented incidents with their sources and outcomes. BTCPay Server has 1 incident on record, 1 not resolved, the latest: "Security advisory: flaw exposing LND credentials exploited before version 2.4.2". Each is listed on this page with its source.

### Do I need an account or email to use BTCPay Server?
No account needed.

### What fees does BTCPay Server charge?
0% processing fees; hosting costs only. Fees were recorded from BTCPay Server's own pages and can change; check before you send.

### Does BTCPay Server have a Tor onion address?
No official onion address was found on BTCPay Server's own pages.

### Which cryptocurrencies does BTCPay Server support?
BTCPay Server supports BTC, LTC, XMR.

### Is BTCPay Server custodial?
No. BTCPay Server is non-custodial: the operator does not control user funds.

### Can I use BTCPay Server over Tor?
BTCPay Server does not publish an official onion address.

## Sources
- https://btcpayserver.org
- https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/
- https://github.com/btcpayserver/btcpayserver

How grades are calculated: https://nokycscore.com/methodology