Security: Multi-Sig Custody, 2FA & Encryption

Wealtii protects your account with encrypted connections, hashed passwords, sign-in verification codes and optional authenticator-app 2FA. Fund assets are held in a public multi-signature vault that anyone can check on-chain. Here is what is in place today:

• 3-of-3 Multi-Signature Vault: Fund assets are held 1:1 in a Gnosis Safe on BNB Smart Chain. Moving vault funds requires all three signatures (3-of-3)
• Public, Verifiable Address: The vault address is published, so anyone can check its holdings on BscScan at any time
• Encrypted Connections: Data travelling between your device and the platform is encrypted with HTTPS (TLS)
• Sign-In Verification & 2FA: One-time codes sent to your email verify sign-ins, and you can add authenticator-app (TOTP) two-factor authentication
• Not Lent or Staked: Fund assets are not lent, staked or rehypothecated

You can check the vault yourself on our Transparency page or follow the step-by-step guide on how to verify Wealtii's reserves.

What you can expect from Wealtii on security:

Where we stand today:

Read our regulatory status for the legal position, and our index methodology for how fund assets are bought and held. We will update this page as each item changes.

How your data is protected in transit and in storage:

Controls that limit abuse of the platform:

• Rate Limiting: Sign-in, registration, verification and withdrawal requests are rate-limited to slow down automated attacks
• Account Lockout: Repeated failed sign-in attempts temporarily lock the account
• Restricted Origins: The API only accepts browser requests from the official Wealtii web app
• Configuration Outside Code: Secrets and sensitive configuration are kept in environment settings, not in source code

Secure development practices used when building the platform:

• OWASP Top 10 as a Checklist: Common web risks such as injection and cross-site scripting are considered when code is written and reviewed (self-assessed, not certified)
• Input Validation: Data sent to the platform is validated before it is processed, and oversized or malformed requests are rejected
• Parameterised Database Queries: Database access uses an ORM with parameterised queries to prevent SQL injection
• File Upload Checks: Uploaded files are checked for type and size
• Disposable Email Blocking: Registration blocks known throwaway email services

How account data is handled:

• Security Event Log: Sign-ins, failed attempts and other security events are logged with a timestamp and device information
• Log Sanitisation: Passwords and tokens are stripped from application logs
• Controlled Changes: Database schema changes go through versioned migrations

How we collect, use and retain personal data is described in our Privacy Policy.

Fund assets are held 1:1 in a Gnosis Safe 3-of-3 multi-signature vault on BNB Smart Chain. A multi-signature vault is a smart-contract wallet that only moves funds when the required number of signatures approve a transaction. For the Wealtii vault, that is all three signatures (3-of-3).

Each user gets a personal deposit address for USDT on BNB Smart Chain (BEP-20):

• Personal Deposit Address: Your address is linked to your account, so incoming USDT can be matched to you
• On-Chain Confirmation: Deposits are credited after 12 block confirmations on BNB Smart Chain
• Correct Network Only: Only send USDT on BNB Smart Chain (BEP-20). Tokens sent on another network or unsupported tokens may be lost
• Card & Bank On-Ramps: If you buy USDT by card or bank transfer, a licensed third-party provider handles that purchase and runs its own identity checks

You do not have to take our word for what the vault holds. To check it:

1. Open the vault on BscScan: 0x54dd6ADaCe8BFd8feAA9cdf1Ca8891c74FaB2583
2. Open the token holdings list to see each BEP-20 token the vault holds
3. Compare the tokens with the holdings listed on each fund page

Wealtii uses one-time codes sent to your email for sign-in verification. You can also turn on authenticator-app two-factor authentication (TOTP), which we strongly recommend:

How sign-in sessions are controlled:

• One Session at a Time: Only one active session is allowed per account. Signing in on a new device ends the previous session
• Automatic Expiry: Sessions expire after a set period and you must sign in again
• New Device Emails: We email you when your account is signed in from a new device
• Sign-In History: Sign-in events are recorded with device information and timestamps
• Verification for Withdrawals: Each withdrawal must be confirmed with an authenticator code (if 2FA is on) or an email verification code

Password rules and storage:

Withdrawals are paid in USDT to an external BEP-20 wallet address you provide. Before a withdrawal is processed:

• Verification Code: You confirm the withdrawal with an authenticator code (if 2FA is on) or a one-time code sent to your email
• Address Validation: The destination address is checked for a valid format before anything is sent
• Additional Review: Some withdrawals, such as unusually large ones, may be held for an extra manual check

How to recognise genuine communication from Wealtii:

If you forget your password:

Automated controls that help protect accounts:

• New Device Emails: You are emailed when your account is signed in from a new device
• Failed Sign-In Lockout: Repeated failed sign-in attempts temporarily lock the account
• Rate Limits: Unusually high request rates are blocked
• Risk Flags: Security events such as repeated failures are logged with a risk level for review
• Transaction Limits: Verification levels set how much you can deposit, buy, sell and withdraw (see the AML/KYC Policy)

What the platform records and flags:

• Security Event Logging: Sign-ins, failed attempts, password resets, 2FA changes and withdrawal requests are logged with a timestamp and device information
• Risk Levels: Logged events carry a risk level so that higher-risk activity can be reviewed first
• Health Checks: Platform services report health status so problems can be spotted and fixed

Simple, rule-based checks that catch common attack patterns:

• Repeated Failed Sign-Ins: Trigger a temporary lockout
• Repeated Password Resets: Are rate-limited and logged
• Unfamiliar Devices: Trigger a new-device email to you
• High Request Rates: Are blocked by the rate limiter

• On-Chain Deposit Verification: Deposits are verified on BNB Smart Chain and credited after 12 confirmations
• Address Validation: Wallet addresses are validated before any withdrawal is sent
• Dependency Updates: Third-party software libraries are reviewed and updated to address known vulnerabilities
• Disposable Email Blocking: Known throwaway email providers are blocked at registration

We use published security guidance as internal reference points. None of these is a certification:

Wealtii has not yet had a third-party security audit. Here is what happens today and what is planned:

Fund assets are held in a Safe (formerly Gnosis Safe) multi-signature wallet on BNB Smart Chain:

• Standard Software: The vault is a Safe wallet, widely used open-source multi-signature software
• 3-of-3 Threshold: Moving vault funds requires all three signatures
• Public Address: The vault address (0x54dd6ADaCe8BFd8feAA9cdf1Ca8891c74FaB2583) can be checked by anyone on BscScan

A penetration test simulates real-world attacks to find weaknesses. Wealtii has not yet had an external penetration test. One is planned, covering the web app, the API and the supporting infrastructure. Until then, testing is internal only, during development and before releases.

If a security incident happens, these are the steps we follow:

If a confirmed breach affects your data or assets, we will tell you:

• When: As quickly as we can after the breach is confirmed, and within any deadline set by applicable law
• How: By email to your registered address and through notices on the platform
• What: What happened, what was affected, what we are doing about it and what you should do
• Authorities: We will cooperate with relevant authorities as required by applicable law

Fund assets are held on-chain in the multi-signature vault, not on Wealtii's servers, so a server outage does not move or erase them. Your fund unit balances are kept in Wealtii's database. Platform updates are released so they can be rolled back if a problem is found. Current platform status is shown on the System Status page.

Wealtii holds no security certifications today. This is what is planned and what is in place:

A plain status list:

See Wealtii's regulatory status for details on registration and licensing.

Planned work, in rough order. Plans can change and no dates are promised:

Follow these simple tips to keep your Wealtii account as secure as possible:

Phishing is one of the most common ways bad actors try to access financial accounts. Here's how to protect yourself: