Security
What follows is what the system provably does by construction, stated plainly. Nothing here is a certification.
Synfin never holds user funds or keys. We generate execution plans; the user's own wallet signs and performs every step, and deposits travel as Canton transfer proposals that stay in the user's wallet until the venue accepts and auto-expire back if it does not. There is no Synfin contract, account, or hot wallet in the money path.
The price floor and the venue memo that carries it are computed by Synfin's servers and delivered inside the plan, never derived by the partner. A mis-built floor is how users lose money, so integrations are not given the chance to build one.
Fee legs are designed to be escrowed alongside the swap and released only on payout evidence that meets the floor. A failed or refunded trade releases nothing: on a refund no fee is taken, and on a below-floor outcome the escrow is held, not paid. This mechanism is proven on devnet; on-ledger fee settlement on mainnet is pending a Synfin mainnet participant and live Amulet locking.
API keys are stored as salted hashes only; the plaintext is shown once at issue time and cannot be recovered by us. Error responses are never cacheable. An infrastructure failure during key verification is answered with a retry signal, never with a silent allow and never misreported as an invalid key.
Found something? Email info@cayvox.com with the subject "Security". Include the affected endpoint, reproduction steps, and impact. We coordinate disclosure timelines with reporters and credit them unless they prefer otherwise.
Synfin has not yet undergone an independent security audit. One is a standing pre-scale gate on our roadmap: it happens before volume does. Until then, this page claims only what the mechanisms above enforce by construction.
