How we keep your funds safe
Here’s exactly what is in place today. We only list measures the system actually runs.
Funds and accounts
Segregated accounts
Separate books per merchant and per app, so funds from different business lines never mix.
Payout and collection wallets kept apart
Payout and collection wallets are separate, so large balances never sit in the wallet used for payouts.
Deposit risk flags
Deposits are tagged by risk level (KYT screening), so suspicious funds stand out at a glance.
Keys
Encrypted private keys
Private keys are encrypted before storage and never written to the database in plain text.
Master key kept apart from the database
The master key used to encrypt private keys is not stored alongside the database — the two are kept separately.
Dashboard access
Two-factor sign-in
Dashboard sign-in supports a second factor via Google Authenticator.
Audit trail
Key dashboard actions are logged, so you can see who did what, and when.
API and webhooks
Signed API requests
Every API request carries an HMAC-SHA256 signature, timestamp and nonce, protecting against tampering and replay.
Signed, replayable webhooks
Webhooks are signed with HMAC-SHA256 so you can verify them, and any you missed can be re-sent.
Availability
Automatic node failover
Each chain runs against multiple nodes, and traffic fails over automatically when one goes down.
Have a security question or found an issue? Email admin@tocs.cn.
Hand collections, sweeping and payouts
to PQPA
Book a demo and we’ll show you exactly how it fits your business.