Wallet & asset controls
Controlled access to asset operations, separation of duties, and authorization requirements for sensitive actions.
Security & risk
Security Is Built Through Layers of Control
Digital asset security requires coordinated technical safeguards, operational procedures, access governance, and continuous risk assessment. No single measure can eliminate every risk.
Layers of control
Four layers that work together
Technical safeguards are only effective when they are supported by process, permissions, and review.
Account & access protection
Multifactor authentication, device controls, and additional verification for sensitive actions where supported.
Internal permissions & approvals
Clear permission tiers, approval workflows, and audit trails that reduce the risk of unilateral action.
Risk monitoring & response
Processes for unusual activity, operational incidents, and changing market conditions, with defined escalation paths.
Operating cycle
Prevent. Detect. Review. Respond.
A layered model assumes that some controls will fail. The purpose of the cycle is to limit impact and to learn from what happened.
01
Prevent
Access restrictions, separation of duties, and technical safeguards limit exposure before an incident occurs.
02
Detect
Monitoring, alerts, and audit trails are used to identify abnormal conditions and unusual activity.
03
Review
Incidents and control failures are examined to establish cause and the scope of any impact.
04
Respond
Documented procedures guide containment, recovery, and communication with affected parties.
Controls
Security is a set of layers, not a badge.
Access governance, transaction monitoring, and incident response are designed to work together, with responsibilities separated by role.
Controls in detail
What each layer covers
The descriptions below are written as practices and expectations. Where a capability is product-dependent, it is identified as such rather than presented as universally available.
- 01
Asset & wallet controls
Asset management practices may include controlled access, separation of operational roles, authorization requirements, transaction monitoring, and documented procedures. Where custody arrangements are described, the scope and limitations should be stated explicitly.
- 02
Account protection
Account safeguards can include multifactor authentication, device controls, suspicious-login alerts, and additional verification for sensitive actions, where supported by the actual product.
- 03
Internal governance
Clear permissions, separation of duties, approval workflows, and audit trails help reduce the risk of unauthorized or accidental actions. Sensitive operations should not depend on a single individual.
- 04
Risk monitoring & response
Risk processes should account for unusual activity, operational incidents, liquidity conditions, and changing market environments, with defined escalation and communication paths.
Incident response
Defined roles, defined steps
Incident response depends on preparation: named responsibilities, tested communication channels, and the authority to contain activity quickly when something goes wrong.
- Detection
- Containment
- Recovery
- Post-incident review
- Disclosure where required
User-facing guidance
Account security also depends on user behaviour: protecting credentials, verifying domains, and treating unsolicited contact with caution.
Third-party risk
Controls extend to providers
Custody, infrastructure, and analytics depend on third parties. Those relationships are governed with the same expectation of evidence.
- 01
Due diligence before onboarding
Security posture, financial standing, and control environment are assessed before a provider handles data or assets.
- 02
Contractual controls
Confidentiality, data-protection, audit, and termination obligations are written into agreements rather than assumed.
- 03
Limited access
Providers receive the minimum access required, and privileged access is reviewed on a schedule.
- 04
Periodic reassessment
Critical providers are reviewed at defined intervals and after material incidents, not only at contract signature.
User-side protection
What we will never ask for
Most account losses start with a message, not a vulnerability. These requests are always illegitimate, whoever they appear to come from.
Your password or one-time codes
No member of staff will ask for your password, a one-time code, or a screenshot of your authenticator.
Your private keys or seed phrase
Keys and recovery phrases should never be shared with anyone, including someone claiming to represent the platform.
Remote access to your device
Support will not ask to install software or take control of your computer or phone.
Understand the risks before you act
Security controls reduce exposure. They do not remove market, custody, or regulatory risk. Read the disclosure before making any decision.