Security & custody
Security isthe product
Yocto Capitals is built money-first. The controls below aren’t bolted on at the edge — they’re enforced in the service layer where the money actually moves.
Four guarantees
01 / FoundationsYour money lives on a ledger
Every balance is the running total of an append-only, double-entry transaction log. No code edits a balance directly — changes land atomically with their ledger entry, or not at all. Corrections are new, offsetting entries, so the full history is always provable.
Large payouts need two people
Withdrawals at or above a configurable threshold require two distinct approvers. Approvals are recorded individually and re-verified at settlement, so a single operator physically cannot release the funds alone.
Sensitive data is encrypted at rest
KYC personal data, two-factor secrets and withdrawal destinations are encrypted with AES-256-GCM. We store ciphertext, never plaintext, and decrypt only server-side for an authorized purpose.
The surface is hardened
Distributed rate limits guard authentication and money endpoints, CSRF protection covers every mutation, sessions are short-rotation httpOnly cookies, and money operations are idempotent so a retry can never double-spend.
Controls on your account
Security is shared. We harden the platform; these are the levers you control directly from your dashboard.
Two-factor authentication
Protect sign-in with a TOTP authenticator app and one-time backup codes. The 2FA secret is confirmed before it is trusted and stored encrypted.
Strong password storage
Passwords are hashed with bcrypt — we never store or can recover the original.
Hardened sessions
Sessions are httpOnly, short-rotation cookies, so a stolen token expires quickly and can’t be read by scripts.
Per-tier withdrawal limits
Rolling-24h limits and cool-down windows between requests cap how fast funds can leave, by account tier.
Verified destinations
Withdrawal destinations are validated and stored encrypted, separate from the rest of your profile.
Full audit trail
Every privileged action is written to an append-only audit log — actor, before/after, IP and device.
Responsible disclosure
Found something? Tell us.
If you believe you’ve found a security vulnerability, we want to hear from you. Email support@yoctocapitals.com with details and steps to reproduce. Please give us a reasonable window to remediate before any public disclosure, and don’t access or modify data that isn’t yours while testing.
For the controls behind these guarantees, read our compliance approach and the full legal documents.
See the controls in action
Open an account and turn on two-factor authentication in minutes.