Frequentlyaskedquestions

Yocto Capitals is a wealth-management platform built on an append-only, double-entry ledger. You deposit funds, earn periodic returns, and withdraw — with every balance derived from an immutable transaction log rather than a number stored by hand.

Yes. Identity verification (KYC) gates access to deposits and withdrawals. You submit identity documents, proof of address and a few personal details, which a compliance reviewer assesses before your money surface unlocks.

The personal data you submit is encrypted at rest with AES-256-GCM the moment it reaches us. We store ciphertext, and only an authorized reviewer can decrypt a profile, and only to review it.

You can deposit by crypto or bank wire. A deposit starts as a pending request; once confirmed it is credited to your wallet through the ledger as a permanent, signed transaction entry.

No. Every money operation carries an idempotency key, so a retry, refresh or double-click can never double-credit or double-debit.

Requesting a withdrawal immediately holds the funds — moving them from available to locked — without changing your total. On payout the debit settles in full as a single all-or-nothing step; a rejection releases the hold back to available.

Withdrawals are subject to your verification status, per-tier rolling-24h limits and cool-down windows. Larger amounts also require two distinct approvers before any funds settle.

Returns are never auto-applied. An administrator drafts a batch, the drafts are reviewed, and only on publish are they credited — each via an idempotent ledger entry tied back to the originating return. Your dashboard reflects the credit in real time.

No. Returns are discretionary, reviewed before publication, and not guaranteed. Investing involves risk, including the possible loss of principal — see our risk disclosure.

You can grow a referral network across tiers from Novice to Apex. Commissions follow the same draft → review → publish loop as returns, and higher tiers unlock higher rates and daily limits.

Turn on two-factor authentication (a TOTP authenticator app plus one-time backup codes) from your security settings, and keep your backup codes somewhere safe. Passwords are stored hashed with bcrypt and sessions are short-rotation httpOnly cookies.

Your email is tied to your verified identity, so it can’t be self-served. Contact support and we’ll help you update it after the appropriate checks.

We welcome responsible disclosure. See the security page for how to reach our team and our expectations around testing and disclosure.