Trust & security
Secure by architecture, not by policy alone.
Money movement is asynchronous, status-driven, and auditable. Users keep custody of their own funds, secrets never touch the database, and every state transition is recorded on a tamper-evident trail.
Principles
How we keep funds and data safe
Self-custodial
Assets stay in the user's own Stellar wallet. NordStern renders deposit and withdrawal flows but never holds user keys.
Secrets isolated
Signing seeds and PSP credentials live in a secrets manager, never in application databases or the repo.
Tamper-evident audit
A hash-chained audit log makes every compliance-relevant action defensible and replayable.
Identity you consent to
KYC is completed once through Didit; sharing verified identity across flows is explicit and consented.
Idempotent money moves
Transfers are matched by memo and never blindly retried — duplicate settlement is designed out.
Config, not code, goes live
Testnet is the default; moving real money is a deliberate, reviewed config change with webhook signature verification.
Go deeper
Security & compliance references
- Security modelThreat model, custody boundary, and secrets architecture.
- Compliance approachFIU-IND, sanctions screening, and monitoring.
- Secrets handlingHow signing and PSP credentials are stored and rotated.
- Stellar SEP-10 authenticationThe wallet authentication protocol we rely on.
- Report a vulnerabilityResponsible disclosure — we respond quickly.