Security Architecture

Separate security domains

Market execution, external data, token contracts and website access have different trust boundaries. A website login check does not prove the safety of a token contract or the correctness of an external market result.

Partner access controls

Partner identity uses server-issued one-time challenges, server-side signature verification and a session cookie. Partner data is scoped server-side by the authenticated wallet’s binding, not merely hidden by the interface.

Claims and evidence

No audit report, deployed protocol contract address or universal multisignature resolution configuration is published here. Do not treat proposed architecture as an audit or security guarantee. Assess published evidence for the exact environment and version being used.