Trust & security

Trust and security model

What's actually built, described plainly — no invented architecture, no claims we can't back up today.

Key management

Encrypted master seed

A single master seed derives every client deposit address across every supported chain, using standard hierarchical-deterministic (HD) wallet derivation. The seed itself is never stored in plain text — it is protected with AES-256-GCM authenticated envelope encryption, with the encryption key held separately from the encrypted data.

Password and session security

Passwords are hashed with argon2id, a memory-hard algorithm — we cannot see or recover your original password, only reset it. Every sign-in creates a tracked session you can review and individually revoke, and changing your password automatically signs out every other active session.

See and revoke your active sessions from the security centre

Withdrawal review

Friction here is intentional. Every withdrawal follows the same real sequence — there is no override that skips a step.

Request submitted

The requested amount is locked out of your available balance immediately — this is a real ledger transaction, not a UI-only state.

Held for review

The request sits in a locked state until an administrator reviews it. There is no automatic release and no override that skips this step.

Released or cancelled

An administrator either releases the withdrawal (it proceeds) or cancels it (the locked amount returns to your available balance).

Today, withdrawal review is a single-approver administrative control, not a multi-signer quorum — we're describing this honestly rather than implying a more elaborate approval process than what's actually built. See our Terms of Service, Section 45, for how this is described in the security centre today.

Segregation and insolvency

Internal accounting segregation

Our internal ledger tracks each client's entitlement separately from Company operating funds at all times, using real double-entry accounting. This is internal accounting segregation, not yet a legally-recognized trust or bankruptcy-remote structure — see the next card for what that distinction means for you.

Treatment on insolvency

Not yet finalized. Until a specific legal structure is disclosed here, you should not assume client assets are legally protected from the Company's general creditors in an insolvency — see our Terms of Service, Section 34, for the full, honest treatment of this risk.

Independent verification

None of the following are in place yet. We'd rather show an honest "not yet" than an invented certification.

SOC 2

Not yet completed

Penetration testing

Not yet completed

Proof of reserves

No independent attestation exists yet.

Insurance

No coverage confirmed yet.