Skip to main content
Request a demo
Company

Security

A security page that lists only what is defended is marketing. The useful half is the list of what is not.

One transaction boundaryThree stacked elements — a record, a rule and a ledger posting — enclosed by a single boundary, indicating that all three commit together or not at all.ONE TRANSACTION BOUNDARYRecordwhat is trueRulewhat is permittedPostingwhat it did to the bookscommit together

What it changes

  1. Tenant isolation in three layersSchema, a client that rewrites every query, and database row-level security with tenant context set per transaction so a pooled connection cannot carry it into the next request.
  2. AuthenticationArgon2id password hashing, opaque revocable sessions rather than JWTs, TOTP second factor, lockout, and step-up re-authentication within a short window for actions that move money.
  3. Data protectionAES-256-GCM field encryption for names, dates of birth and tax identifiers, with the attributes compliance rules need kept in the clear so the policy engine never decrypts at scale.
  4. AuditHash-chained and append-only, enforced by revoked grants and database triggers so tampering fails rather than merely being detectable.
Ask, agree, then actThree steps. One person requests, a different person approves, and only then does the state change. The approval binds to what was requested, so editing it afterwards invalidates the sign-off.Requestone personApprovea different oneActnow it movesThe approval binds to what was asked.Edit it afterwards and the sign-off is void.
Every irreversible act on this platform takes this shape, whatever the subject of the page: one person asks, a different one agrees, and only then does anything move.

What it includes

Content Security PolicyPer-request nonce rather than unsafe-inline, which would provide essentially no protection for scripts.
TransportHSTS with a two-year max-age and preload; database connections verify the certificate chain rather than merely encrypting.
Maker-checkerNine permissions execute only from an approval queue, bound to a hash of what was approved.

Questions

How do I report a vulnerability?

Contact us through the details on the contact page. We would rather hear about it than not.

Has this been audited?

No. An external smart-contract audit and a penetration test are launch gates in our own specification, and neither has been completed.

See it against something real.

Bring an instrument you are actually considering. Structuring it is the only way to judge whether the model fits.

Request Enterprise DemoBack to company
Your instrument, against this modelAn unspecified asset on the left feeds four stages: structure, compliance policy, the offering book and the register. The asset is drawn as an outline because it is the reader's, not the platform's.Your assetwhatever it isStructurePolicyBookRegister