Security & Trust¶
This section is written for allocators, partners, and reviewers performing due diligence. It covers the four questions we are asked most:
-
Why ARKONIX is non-custodial, exactly what operational keys can and cannot do, and how they are stored.
-
The independent security program: external black-box testing and source-level white-box review.
-
How users, partners, and wallets authenticate: JWT, SIWE, and HMAC request signing.
-
On-chain verifiability
Positions, settlements, and share prices are on-chain facts — every series the platform publishes can be independently recomputed. See Protocol Layer.
Security posture in five statements¶
- User funds are never in ARKONIX custody. Deposits and withdrawals settle directly between user wallets and vault contracts.
- Operational keys are hardware-isolated. All platform signing happens in cloud HSMs (FIPS 140-2 Level 3); private keys are not exportable, and services hold sign-only permissions.
- Execution is layered. Strategy transactions pass simulation and risk controls (limits, circuit breakers, drawdown monitoring) before signing.
- Independent testing is continuous, not ceremonial. External black-box penetration testing of the live surfaces and white-box source review are run as separate engagements with an independent security firm.
- Everything that matters is verifiable. Vault holdings, settlements, and NAV updates are on-chain events with public history.
Responsible disclosure¶
If you believe you have found a security issue in any ARKONIX system, please report it to info@arkonix.xyz with "SECURITY" in the subject line. Include reproduction steps and impact; we acknowledge reports promptly and keep reporters informed through remediation. Please do not test against production systems holding user funds without coordination.