Security
Your money is protected by how the system is built, not by asking you to guard a key. This is a Testnet release with no real funds; the controls below are the ones the design holds to before real value moves through it.
Custodial, with one pooled treasury. You never hold a private key, so a lost or phished key is not a category of problem that exists here. Account recovery is identity-based.
Balances live in a double-entry ledger that must balance to zero per currency. A balance is derived from its entries, never a stored figure that can drift. An unbalanced write is rejected by the database, not just by code.
Every administrative action and every value-moving event is written to an append-only audit log — actor, action, target, timestamp. Entries cannot be edited or deleted through the app.
The treasury address is public. Two reconciliation checks run and are reported separately: that customers are covered, and that every movement is accounted for.
Argon2id hashing, no plaintext or reversible storage. Authentication and every value-moving endpoint are rate limited.
There is no route from an administrator session to customer funds or signing keys. Admins can read; they cannot transfer.