Our software stack protects keys, transactions and personal data with independent, post-quantum defenses. An attacker has to break all of them, not just one.
Layers are listed from the outside in. Each has its own threat model, its own tests and its own audit scope, so a flaw in one never quietly weakens another.
All traffic between apps, devices and services is encrypted with a hybrid key exchange, so recordings made today can't be decrypted later.
Private keys exist only as shares spread across separate devices and secure hardware. A quorum signs together; no participant ever sees the whole key.
Transactions and software releases carry both a classical and a post-quantum signature. Both must verify, so breaking either algorithm alone achieves nothing.
User data is encrypted with per-record keys, which are themselves wrapped by keys held in hardware. A stolen database is just noise.
Every key operation and configuration change is appended to a hash-chained log. Altering or deleting history is detectable by anyone holding an earlier checkpoint.
We only use algorithms standardized by NIST or the IETF with years of public cryptanalysis. Our job is careful composition, not inventing ciphers.
Algorithms are referenced by identifier, never hard-coded. Replacing one is a configuration change with a tested migration, not a rewrite.
Anyone can rebuild our releases from source and get byte-identical binaries, each signed with a hybrid signature.
Security-critical code is written in Rust. Any unsafe block needs a written justification and a second reviewer.
Code that touches secret data must not branch or index on it. We check this automatically in CI on every change.
Core cryptographic libraries are published under a permissive license. Security that depends on secrecy of the code isn't security.
Different methods catch different kinds of failure. We use all of them, and we publish our coverage so you don't have to take our word for it.
| Method | What it catches | When it runs | Release bar |
|---|---|---|---|
| Known-answer tests | Any deviation from official NIST test vectors | Every commit | 100% of published vectors pass |
| Property-based testing | Edge cases in encoding, parsing and arithmetic | Every commit | No failing properties |
| Continuous fuzzing | Crashes, panics and memory errors on malformed input | 24/7 on dedicated machines | No open crash findings |
| Constant-time analysis | Timing leaks from secret-dependent branches or memory access | Every commit | Zero flagged paths in secret code |
| Formal verification | Logic errors that tests miss in parsers and state machines | On spec or code change | Proofs pass for all critical modules |
| Differential testing | Disagreements between our code and other implementations | Nightly | No unexplained differences |
| External audit | Design flaws and anything our own team overlooked | Before every major release | No open high or critical findings |
| Bug bounty | Issues found by the wider security community | Always open | Fixes disclosed after patching |
Two reviewers, one from outside the team, sign off on any change touching keys or cryptography.
Tests, fuzz smoke runs and constant-time checks must all pass before merge.
The build runs on testnet and internal devices under continuous fuzzing for at least two weeks.
Major releases go to an independent firm. Findings are fixed and re-checked.
Reproducible build, hybrid-signed, logged to the transparency log, then shipped.