How the blocks are built, secured and shipped.
For your security team and your auditors. The short version is below; the architecture document, pen-test summaries and runbooks are shared under NDA after the first call.
2FA on every account, staff included
Role-based access; each person and each service reaches only what it needs. Every internal action is recorded with the operator's identity.
Stored encrypted, apart from the applications
Hot, warm and cold tiers with thresholds. HSM integration on request. Self-hosted and source deployments keep keys entirely inside your perimeter.
Books reconciled with the chain, not just with themselves
An independent monitor reads balances on-chain and alerts on any mismatch. A check that can't complete is reported as unknown, never as fine.
Whitelists, quorums, delays
Outgoing transfers need M-of-N approval above thresholds; new addresses wait; every approval is a 2FA event.
Isolated environment per product, Cloudflare at the edge
WAF and DDoS protection in front of web and API; encryption in transit and at rest; chain bridges and signers reachable only from inside the platform's private network.
Encrypted nightly backups, rehearsed rebuild
Encrypted and sent off-site every night. A restore drill on new hardware is part of every delivery.
Proven tools, one foundation.
Every block shares the same core for accounts, security, custody and operations. These are the main technologies your engineers will meet in the source and the runbooks.
- Exchange
- Ruby on Rails and Go on the trading path · MySQL, Redis, RabbitMQ · live market data over WebSockets
- Apps & web
- React trading web app · React Native for iOS and Android · Next.js and Astro for the websites
- Wallet
- React Native mobile · Rust + Tauri desktop (macOS, Windows) · one TypeScript wallet engine
- Payments
- Next.js and TypeScript checkout and merchant panel · REST API with HMAC-signed webhooks
- Security
- 2FA everywhere · role-based access · encryption in transit and at rest · Sumsub + Didit identity · keys apart from apps
- Infrastructure
- Dedicated EU servers (Hetzner) or your AWS · isolated environment per product · Cloudflare at the edge · encrypted nightly off-site backups
- Engineering
- 1,000+ automated tests · every release built from version control, rolled back in seconds · monitoring for uptime, certificates, backups and payments
You approve every production change.
- 01
Build and test
Release built from version control, 1,000+ automated tests must pass.
- 02
Staging
Deployed to your staging; changelog and test report posted in the client portal.
- 03
Your approval
Your admin approves a maintenance window. Security fixes can be expedited with your sign-off.
- 04
Production
Rolled out to production; rollback is one command and takes seconds.
Security review?
Send your questionnaire. We answer it in writing and walk your team through the architecture under NDA.