Security & compliance
Clear controls, clear responsibilities.
Every programme runs with verification and review appropriate to its services, and with documented responsibility for each regulated service.
Practices
What clients can expect.
- VerificationIndividual and business verification, with business reviews by our compliance team.
- Mandatory controlsEach partner's controls apply to every service it provides.
- Named responsibilityEach regulated service names its provider in the programme terms.
- Due diligenceSecurity and compliance documentation is shared with prospective clients during due diligence.
Platform controls
How the platform is controlled.
- Role-based accessEach dashboard user has a role, and sees and does only what that role allows.
- Second approvalPayments, limits and configuration changes can require approval by a second person.
- One ledger, reconciledEvery movement is recorded in the ledger and reconciled against the accounts and wallets held by partners.
- Wallet policiesWallets run on institutional wallet infrastructure with multi-party key management and transaction policies.
- Separate environmentsTest and live environments are separate, and each client's data is kept apart.
Financial crime
Screening and monitoring.
- VerificationIdentity checks with document and liveness verification, and business verification including beneficial owners.
- Sanctions screeningCustomers and payments are screened at onboarding and on an ongoing basis.
- Blockchain analyticsWallet addresses and transfers are screened for crypto-asset services.
- Travel RuleOriginator and beneficiary information is exchanged for crypto-asset transfers where the law requires it.
Documents
Policies and due diligence.
Read our AML and sanctions statement, data processing addendum, acceptable use policy and legal entities. Security and compliance documentation, including our due-diligence questionnaire, is shared with prospective clients and partners during due diligence.
Report
Report a security concern.
Email support@axorastack.com with what you found and how to reproduce it. Do not send passwords or keys, and do not access data that is not yours or disrupt the service while testing. We reply to every report.