Safety and Security

We provide our customers with some of the most robust security tools and features in the industry.

Infrastructure

Our infrastructure is hosted on Amazon Web Services, which offers a secure environment for the services that we offer to our customers to ensure the safest possible access control, data encryption, monitoring and isolation.

Our internal networks are protected by firewalls and not exposed to the internet. All internet traffic is also encrypted to the same standard as those provided by external services. Our firewall policies are designed to allow minimum permissions for different applications and roles to interact.

All application and database servers are running inside private networks, with isolation between staging and production environments. Public-facing services are made available by dedicated load balancers that only handle HTTPS requests.

Deep freeze storage

Mamoru stores the majority of its customers' cryptocurrencies in “deep freeze” utilising a multi-signature wallet in which the keys are generated and stored fully offline and offshore. The keys are managed by Zodia Custody, a leading digital asset custodian.

Hot wallet

Mamoru employs a multi-signature hot wallet to enable rapid Bitcoin transactions. We keep backups of the keys offline in geographically distributed safe deposit boxes. Three keys are required, with one kept by an external custodian for further security. The external custodian also imposes velocity restrictions.

Air Gaps

Private keys are kept offline and offshore, on a machine that is not connected to the internet or other networks. This drastically lowers the attack surface because physical access is necessary. Mamoru keeps the airgap machine in a safe within a regulated security vault at an undisclosed offsite location.

Two factor authentication

Mamoru uses Two-factor authentication (2FA) to provide users with an additional level of authentication prior to onboarding in order to assure customer security. When a customer activates 2FA, they enhance the account's security by generating a one-time code, which they can only receive on their smartphone.

Passwords

Mamoru stores passwords in hashed form, ensuring that only the customer can access them. Mamoru makes sure that customers use a strong password when they sign up with Mamoru. Customers need to change their password every 90 days.

IP Address Whitelist Check

Customer can only access our system via a whitelisted IP address. We use the registration IP address as the default for customer first login.