Bank-level protection, top to bottom.

Encryption

• In transit: TLS 1.2+ only, HSTS preload, and a strict Content Security Policy on every page.
• At rest: personal data (phone, date of birth, address, tax ID, bank details) and two-factor secrets are encrypted field-by-field with AES-256-GCM using versioned keys, so the database alone reveals nothing.
• Passwords: hashed with Argon2id (64 MB memory, 4 iterations). We never see or store your password.

Account access

• Two-factor authentication with any TOTP authenticator app, plus one-time backup codes.
• Step-up authentication on every send: your authenticator code or password is required to move money.
• Automatic lock-out after repeated failed sign-ins, rate limiting by IP and by account, and email alerts for lock-outs, password changes and 2FA changes.
• Sessions expire after 15 minutes idle and 12 hours absolute; you can sign out every other device from Settings.

Custody

• We are the custodian. Customer wallets are managed entirely by Stabality's own infrastructure — no third-party custody provider ever touches your assets.
• Every deposit address on every network derives from a single hierarchical-deterministic master key held under AES-256-GCM encryption, generated and backed up in a controlled ceremony. Private keys are never written to the database and never leave our systems.
• Outbound transfers are signed in-house with deterministic ECDSA (RFC 6979), reviewed against limits, and broadcast to nodes we select; funds are held (not spendable) until the network confirms.
• Customer deposits are consolidated into segregated treasury wallets on a scheduled cadence, keeping individual deposit addresses low-value.

Ledger integrity

• Every balance change is an append-only ledger entry with the resulting balance recorded. Nothing is ever edited or deleted.
• Money math is exact integer arithmetic, never floating point.
• Daily yield is idempotent per account per day; a re-run can never double-pay.
• All security-relevant actions, by customers and by staff, land in a tamper-evident audit log.

Responsible disclosure

Found something? Email security@stabality.com. We respond within one business day and do not pursue researchers acting in good faith.