Security
Bank-Grade Security
Built for fintech compliance — encryption, custody controls, audit trails, and zero-trust architecture.
Encrypted Key Custody
Custodial wallet private keys are AES-256-GCM encrypted at rest. Keys are never stored in plaintext or logged.
AWS Secrets Manager
All credentials injected at runtime per environment. No secrets in source code or container images.
MFA Authentication
TOTP-based multi-factor authentication via AWS Cognito for all customer accounts.
WAF Protection
AWS WAF baseline with rate limiting, IP reputation, and common exploit protection on all ALB endpoints.
CI/CD Security Gates
Semgrep SAST and Trivy container scanning run on every build. Critical findings block deployment.
Environment Isolation
Separate AWS accounts for dev, staging, and production with least-privilege IAM boundaries.