The strongest control is the one that can't be bypassed because it's structural. These are the practices behind every Unykorn deployment.
2-of-3 multisignature everywhere value lives: client backup key, platform user key, BitGo custodian key. No single party — including us — can move value alone.
Every contract passes a structured internal security review — reentrancy, access control, oracle manipulation, determinism — before any mainnet promotion, with independent audit firms engaged for high-value launches.
Compliance decisions and settlements land in a cryptographically signed, append-only trail — tamper-evident and verifiable without trusting Unykorn systems.
Integer minor units only. No floating point, no wall-clock dependence, no unseeded randomness in any money path — the same inputs always produce the same state.
Scoped, rotating credentials; secrets supplied per-session and never stored in code, memory systems, or repositories. Webhooks verified with HMAC signatures and processed idempotently.
Per-tenant wallets, routing, and data — no omnibus commingling, no shared credentials, and a compliance gate in front of tenant provisioning itself.
Security disclosures: institutional+security@unykorn.ai
UNYKORN