Security and proof of reserves
Client funds segregated
Client INR sits in a separate escrow account and client BTC in segregated custody. A database constraint refuses any journal that mixes client and house funds.
Custody
Deposits are swept to MPC custody; cold and warm movements need two approvers, and every outgoing BTC address is screened before broadcast.
Tamper-evident records
Every ledger posting, admin action and order is written to hash-chained, append-only logs verified every minute.
Account protection
Two-factor authentication, device approval, withdrawal address whitelists with a cooling-off period, and an anti-phishing code in every email.
Data stays in India
All primary data, backups and logs are kept in AWS Mumbai and Hyderabad.
Proof of reserves
We publish a Merkle-sum tree of every client balance. You can check that your balance is included from your account page, and compare total client liabilities with the reserves we hold.
| Asset | Client liabilities | Reserves | Accounts | Merkle root |
|---|---|---|---|---|
| The first proof-of-reserves report will be published at launch. | ||||
Responsible disclosure and bug bounty
If you find a security issue, report it to us privately. Test only against your own account, never access or change other users' data, and do not degrade the service. We will not take legal action over good-faith research within these rules. Valid reports are rewarded according to severity; critical issues are escalated to our incident process the same day.