Trust Center
What we can show you before you ask.
The audits, certifications, insurance and legal structure behind Hex Trust custody, and the security architecture underneath — collected for the people whose job is to check.
Independent assurance
Audited, certified, tested.
Reports are available to clients and prospects under NDA. Ask the line you are talking to.
Design and operating effectiveness of the controls relevant to client financial reporting, asset segregation and fiduciary responsibility.
Security, availability, processing integrity, confidentiality and privacy — the design of the controls.
The same criteria, tested in operation over a period.
Third-party certification of cloud security controls against the Cloud Controls Matrix, listed on the public STAR Registry. Hex Trust is a corporate member of the CSA.
Quality, information security and business continuity management at the facilities hosting our infrastructure, which also meet the ANSI/TIA-942-A data-centre standard.
Keys are generated and used inside validated Securosys Primus HSMs: tamper-evident enclosures, role-based authentication, automatic zeroisation on physical tampering.
Regular testing of the platform against the current threat landscape, by a CREST-accredited firm.
Security embedded through the software development lifecycle, with trusted partners enforcing a secure SDLC on the platform.
How assets are held
Segregated, insolvency-remote, insured.
Where client assets sit, legally and technically, and what protects them.
Segregated on-chain accounts
Client holdings are kept in distinct, verifiable wallets — legally and technologically separate from Hex Trust’s own capital and from other clients’. Nothing is commingled.
Insolvency-remote structure
Client digital assets are legally distinct from the firm’s estate. In an insolvency, neither Hex Trust’s creditors nor any other party has a claim on them.
Insurance
Cover of up to US$25 million and above for digital assets held in custody, against theft or loss. The Insurance Coverage Framework sets out the terms.
Air-gapped signing
Private keys live in FIPS 140-3 Level 3 HSMs in an air-gapped environment, separated from connected systems by a cross-domain solution built on data diodes.
Policy engine and approvals
Clients define who may view, initiate and approve; multi-level approval workflows and transaction policies enforce it; a full audit trail records it.
Zero Trust architecture
Layered defences and strict, identity-based access control around every system, with enforced controls on privileged and external access to sensitive data.
On-chain screening
Chainalysis KYT for transaction monitoring and Chainalysis Reactor for investigations, integrated into the compliance framework.
Cloud and monitoring
Applications hosted on AWS and Google Cloud, monitored around the clock.
Licences
Licences and registrations.
Security notice
Report a vulnerability.
If you believe you have found a vulnerability in a Hex Trust system, tell us privately first. The security notice explains how, and what you can expect from us.
Security notice →Send us your due-diligence questionnaire.
We answer it in full, with the reports behind each answer.