About
Built like financial infrastructure
We build the boring parts properly: accounting, custody separation, approvals and audit. Everything a customer sees rests on those four.
How we work
The ledger is the source of truth
No balance is ever written directly. Every movement is a balanced double-entry transaction with an immutable journal, enforced by database triggers as well as application code. If the numbers disagree, reconciliation files a discrepancy rather than quietly correcting itself.
Keys are separated from the application
The API and the indexer hold watch-only extended public keys. Signing lives in an isolated service reachable only from the internal network and authenticated with a shared secret. The interface is deliberately compatible with an external custodian.
Money moves after review
Withdrawals pass validation, limits, velocity checks and risk scoring, then an approval tier decides whether they settle automatically, need one reviewer, or need two distinct reviewers.
Everything staff do is recorded
Every staff mutation writes an audit entry with the before and after state, the reason, and the request identifier. The audit table is append-only and there is no interface that can delete from it.
Demo and production are the same code
This environment runs in demo mode: the chain, market data, email and identity verification are mock providers, and every record they produce is labelled as demo. The business logic, the ledger and the guards are identical to production — only the adapters are swapped.
Get in touch