Segregated client funds
Client currency is held in accounts kept for clients and recorded against each client in our ledger. It is not used for the company's own costs, balance sheet or trading.
Custody and controls
Client assets, held apart.
Client money does not mix with the company's own. The majority of digital assets sit offline, every transfer needs more than one approval, and the reserve ledger can be checked against your own balance.
Custody
The custody model
Three controls, in the order they apply: separation, storage, approval.
Majority cold storage
Most digital assets are held offline, on keys that never touch a machine with a network connection. A small working balance stays online so same-day withdrawals can settle.
Multi-party approval
No one person can move client assets. A withdrawal is proposed, reviewed and approved by separate holders on separate devices before it is signed, and the thresholds that trigger a further approval are set in advance.
Reserves
Proof of reserves
Each publication takes every client balance, hashes it into a leaf, and combines the leaves in pairs until one root remains. The root is published with the total of client liabilities. You can check that your own balance sits inside that root without learning anyone else's.
Your balance and a salt held only for your account are hashed into a leaf.
Leaves are hashed in pairs, level by level, until a single root remains.
The root is published together with the total of client liabilities.
Your inclusion proof is the short list of sibling hashes along the path from your leaf to the root. Hashing them in order reproduces the published root, or it does not.
- Your path to the root
- Hashes given to you as the proof
- Other balances, never revealed
No outside firm has examined these figures, and nothing on this page is an audit.
Transfers
Travel Rule
When a transfer leaves Aerarium for another provider, a defined set of data travels with it, and the same set is checked on anything arriving. The exchange happens provider to provider over an encrypted channel; it is kept with the transaction record and never published.
If the provider at the other end cannot receive and acknowledge that data, the transfer is not sent.
What travels with a transfer
- The originator's name as held on the account
- An account reference for the originator, not the account itself
- The beneficiary's name as given by the receiving provider
- The destination address, and the network it belongs to
Screening
Sanctions screening
Names are screened when an account is opened and again whenever the details on it change. Wallet addresses are screened before an order is accepted and once more before a payout is released.
A possible match stops the order and goes to a person. Nothing is refused automatically on a name alone, and a refusal is recorded with the reason.
Operations
Incident response
An engineer is on call at all hours. Incidents are classed by their effect on client funds first and on access to the service second.
-
Contain
Withdrawals and the affected path are stopped before anything else is attempted.
-
Notify
Affected clients receive a written notice with what is known, what is not, and what to do.
-
Publish
A written account of what happened and what changed follows once the incident is closed.
Disclosure
Responsible disclosure
Report a weakness to the address below, with enough detail to reproduce it. Every report is acknowledged, the reporter is kept informed while it is being fixed, and credit is given to anyone who wants it.
Security contact
security@aerarium.example
Written out rather than linked. Do not include client data in a first report.
In scope
- This site and its exchange flows
- Anything that would let one account read or move another's
- Anything that would expose client data, proofs or reserve records
Out of scope
- Denial-of-service and load testing of any kind
- Social engineering of staff, clients or partners
- Reports against other people's accounts or third-party systems
Researchers acting in good faith within these terms will not be pursued.
No monetary reward is offered.