Built like a vault, not an app.

Client assets held with a regulated institutional custodian using multi-party computation (MPC) key management and cold storage. Member assets segregated from operating funds.

Insurance on custodial holdings via our custody partner’s underwriters. Coverage terms are published when the partner is confirmed.

Independent reserve attestation by an external accounting firm, confirming assets meet or exceed member liabilities — published on a regular cadence.

Operated by Perdura Capital Market Inc, a Cayman Islands exempted company (Reg. SN-305482, incorporated 3 Nov 2020) — verifiable on the government registry at verify.gov.ky. Incorporation, not a financial-services licence.

Independent audit of our security, availability, and confidentiality controls. Programme underway; report published on completion.

Information-security management certification. Implementation in progress ahead of launch.

Identity verification and anti-money-laundering screening are required before any account can hold funds.

Every loan is backed by more than its value, with automatic liquidation buffers to protect the loan book.

Built on Supabase — a SOC 2 Type 2-compliant platform — for authentication, database, and encrypted storage.

Served over Vercel’s global edge with automatic TLS and DDoS mitigation. All traffic encrypted in transit (HTTPS).

Every member’s records are fenced off at the database with row-level security — your data is never reachable from another account.

Identity documents are kept in private, access-controlled storage, scoped to you and used only for verification.

Administrative and service credentials are server-side only and never exposed to the browser. Admin surfaces are role-gated.

KYC approval is locked to authorized staff — members cannot alter their own verification status. Every sensitive action is validated server-side.

Minimum-length passwords enforced at sign-up, with secure, industry-standard authentication.

Optional TOTP 2FA from an authenticator app, enforced at every login for an extra layer beyond your password.

Withdrawals and sends can only go to addresses you’ve pre-approved — enforced server-side, so funds can’t leave to an unknown destination.

Real-time notifications for sign-ins and withdrawal requests, so you see account activity as it happens. Rolling out.