OP, could you provide clarification of these statements please?
As additional security we do not keep any user's money (bitcoin, altcoins) on our servers.
All received payments are automatically forwarded to user's external wallet addresses within the next 30 minutes.
If the funds are forwarded "within 30 minutes" then that must mean that:
1) Customer Funds are initially paid to an address controlled by GoUrl, not by me (merchant)
2) For some period of time ( even if only 1 second ) the funds are within your control, not mine.
3) The private keys for the addresses you control may be stored on your servers, or may possibly be stored offline.
I found this thread while looking for a shopping cart solution where:
1) Funds are paid directly from customer to me ( merchant )
2) It is not necessary for me to have private keys on the server. Eg, I would pre-generate addresses or use bip32/xpub for shopping cart.
But if I understand correctly, you do not provide the solution I am looking for. Rather, you insert yourselves into the middle so that you can take a cut, right?
How do you deal with point (3) above? Do you keep any keys on the server? Or if not, then exactly how are you providing unique addresses for each purchase?
And also, the funds make at least one extra hop, which entails additional mining fees and confirmation time. yes?