Security, stated plainly

External endpoints terminate TLS 1.3 at Cloudflare. Internally, the resource platform reaches the signer over mutual TLS with full certificate verification; the wallet bot presents a client certificate but does not yet verify the signer's certificate, and the TRON broadcaster is reached over plain HTTP on a private Docker network. We do not do certificate pinning. Closing the two remaining gaps is tracked work.

Deposit-address private keys are stored encrypted in our PostgreSQL database, not in a key vault. They are encrypted with Fernet (AES-128-CBC plus HMAC-SHA256) under a key derived by PBKDF2-HMAC-SHA256. Keys are currently written at 600,000 iterations; keys written under earlier parameters stay readable, because we retain every past derivation setting permanently rather than leave stored data undecryptable. The master key that derivation starts from is held in AWS Secrets Manager under IAM policy and delivered to containers in memory at start-up. Hot-wallet keys are held by the signer service, sourced from the same Secrets Manager store.

No operator approves a withdrawal the platform can price -- at any amount, at every verification level. Every withdrawal is scored by a risk engine before signing, and a flag is recorded and sent to the operators as an alert -- it does not hold the withdrawal. A withdrawal whose value cannot be priced is refused while the platform-wide outflow ceiling below is on, because that ceiling cannot be checked without a price; with that ceiling off -- and always for a transfer to another account on the platform, which the ceiling does not count -- it waits for two operators.

No per-account ceiling applies to a single withdrawal or to what one account withdraws in a day, at any level. What caps outflow is platform-wide: a daily outflow ceiling across every account and asset, and the signing service's own ceilings on any single withdrawal it signs and on its withdrawal total for a rolling day. A withdrawal that would pass any of them is refused. They are limits we enforce against abuse, not allowances we grant, and verification does not lift them.

Hot-wallet signing runs in a separate signer container on its own network segment, with no outbound network access and a bearer token on every request; application services never see hot-wallet key material. Sweeps from individual deposit addresses are the exception: the wallet service decrypts that address's own private key inside its own process. On TRON the decrypted key is then handed to the signer, which builds and signs; on every other chain the wallet service signs locally. Moving deposit sweeps behind the signer is tracked work.

Every custody action is written to a SHA-256 hash-chained audit log in PostgreSQL: each entry commits to the previous entry's hash and to a hash of its own payload. A verifier walks the chain every hour and alerts on any edited, deleted or inserted row. This detects tampering rather than preventing it -- entries are not yet written to write-once storage, so an operator with database access can still delete a row, and the chain will show that they did.

Infrastructure monitoring via Prometheus, Grafana, and Loki, with automated alerting on anomalous transactions, reconciliation shortfalls, and system health. Operational log retention is 72 hours; the audit log in PostgreSQL is separate and is not on that clock.

Services run in isolated Docker containers with dedicated internal networks. Database access is restricted to services that require it, and the signer has no route to the public internet.