Security

Designed so you do not have to trust it blindly.

CryptoRail holds no key, acts only within the approvals and policies you define, and records everything it does. Every statement on this page is tied to a numbered requirement and a test, and what has not been proven yet is said plainly.

See the evidence

Keys

Your keys never enter CryptoRail.

CryptoRail asks for signatures; it never holds what produces them. The key stays in your HSM, in a cloud KMS key in your own account, or behind your own signing service, and every signature is checked before it is used.

Keys never enter CryptoRail: signing happens in your HSM, your cloud KMS or your own signer, and only the development signer ever touches a key.
Your own signer keeps the key: CryptoRail prepares the exact bytes, your system signs them, CryptoRail verifies and broadcasts.
Keys in a hardware security module over PKCS#11 (Thales, Utimaco, Entrust, AWS CloudHSM): tested on every change against SoftHSM2, each vendor declared after a manual test on its device. Built, certification pending
Signing keys in AWS KMS, with the curve checked at startup. Built, certification pending
Every signature is checked against the expected address before anything is sent.
Signing with Azure Key Vault or GCP Cloud KMS, or through Fireblocks. On request

flowchart TD
    subgraph CR[CryptoRail]
        P[Prepares, checks policy and approvals]
        V[Verifies the signature]
    end
    subgraph YOU[Your side]
        K[HSM, cloud KMS in your account, or your signer]
        A[Your approvers]
    end
    A -->|EIP-712 approvals| P
    P -->|exact bytes to sign| K
    K -->|signature| V
    V --> N[Network]

Control

Nothing moves without the approvals you require.

Policies decide before anything happens, quorums of approvers sign what will actually be executed, and, where the rules demand it, the chain itself refuses an operation that lacks them.

Declarative policies decide before anything happens: limits per operation, payer and period, held even when several workers decide at once.
Operations above a threshold wait for a quorum of approvers, who sign an EIP-712 digest that names neither nonce nor fee.
When required, approvals are enforced on chain by a smart account: the signing key alone cannot move anything.
Every approval, signature and decision is recorded with who, when and what, and every change made through the API lands in an audit log.
The complete history of any operation, exported in a machine-readable file for audit.

Platform

Least privilege, by construction.

Each process can reach only what its job needs, secrets are never copied into the system, and one customer's data is invisible to another, proven on every route.

One process, or separate API, worker, signing gate and indexer processes sharing only the database, each with a database role limited to what it needs.
Secrets passed by reference and never written to logs, traces, metrics or responses.
A tenant sees only its own resources, proven on every route of the API on every change.
Signed webhooks, retried for about three days, then held in a dead-letter queue an operator can redeliver from.
The hosted profile refuses to start if it is given a key of its own, listing every reason.
Dependencies scanned on every change; a high or critical vulnerability blocks the release.

How it is tested

Requirements, tests and scenarios you can read.

Every capability starts as a numbered requirement approved for the product. Automated tests name the requirement they prove, and end-to-end scenarios replay real situations, failures included, producing a report a reviewer can read step by step: the request, the response, the state and the events.

The evidence page lists every claim on this site with the requirement, scenario or decision record behind it.

Tested on every change to the code against Anvil and a Hyperledger Besu QBFT network, and run on public test networks by recorded manual procedures.
Tested with a real wallet on a public test network, beyond the automated tests against a bundler.
A tenant sees only its own resources, proven on every route of the API on every change.

Still to come

What has not been proven yet.

No external security audit has been carried out yet. Self-hosted deployments and pilots are offered today; running CryptoRail for you in production waits for that audit.

Some signers are built and tested against emulators but not yet declared: each HSM vendor after a manual test on its device, AWS KMS after a manual test on a real account. They are marked as such wherever they appear.

Out of scope by design