My query is about the security - or lack thereof - of private view keys when they are placed on a server (web host) as part of a payment integration system to accept Monero payments from customers. As it says here:
https://github.com/monero-integrations/monerowp Secret Viewkey (if confirmation type is viewkey) - Your private viewkey (No default) Monero wallet RPC Host/IP (if confirmation type is monero-wallet-rpc) - IP address where the wallet rpc is running. It is highly discouraged to run the wallet anywhere other than the local server! (Default: 127.0.0.1)
So does this mean that the website hosting company has access to private view keys if the Monero Wallet RPC is on the same server as the website? It means they can see the funds?
I ask because i wonder if you can host the RPC elsewhere, at home for example, but the 'good practice' advice in the help files says that it should be on the same server as website.
I am aware that the funds will be safe on a hard wallet, but what to do if you don't want personnel (server admin and staff) connected to the webhost company to see what should be private info?
What is the Payment Wallet RPC or what does it connect to? a special node for payments?