Phlebas Trust Center Report a security issue

Credit infrastructure for stablecoin-native finance

Trust Center

Security and operational resilience are foundational to the infrastructure we build for lenders and partners. This page summarizes our current practices and roadmap.

security@phlebas.finance Security enquiries & responsible disclosure

Security overview

Our controls cover infrastructure, access, application security, wallet-provider integrations, transaction risk intelligence, and compliance governance. The information below reflects our present posture unless explicitly marked as roadmap.

Infrastructure & data

Current
  • Application infrastructure is hosted on Google Cloud, with Neon providing the managed database layer
  • Data encrypted at rest and in transit
  • Application secrets managed through Google Cloud Secret Manager
  • Production and non-production environments isolated across services, storage, secret namespaces, and databases

Access control

Current
  • Named individual access granted on a least-privilege basis
  • MFA required; shared credentials prohibited
  • Distinct runtime service accounts with scoped secret access

Vulnerability management

Current
  • Continuous automated scanning via Aikido across source code, dependencies, container images, cloud configuration, and our public domain
  • Alerting on new CVEs and configuration drift
  • Internal security assessment and tenant-isolation testing completed August 2026; reports available to partners on request
  • Periodic third-party manual penetration testing is planned as we scale

Wallet infrastructure

Current
  • Funds held in industry-standard MPC vaults with institutional custody providers
  • Transaction co-signers run on dedicated shielded virtual machines with secure boot, with signing state encrypted under Google Cloud KMS keys
  • Transfers restricted to pre-approved destination addresses

Transaction risk intelligence

Expanding
  • Chainalysis in use for blockchain risk intelligence
  • Broader integration into platform risk workflows underway

Governance & compliance

Active
  • Advisory board comprising experienced compliance, credit, and treasury advisors
  • Compliance program includes AML and KYT policies and procedures
Compliance roadmap

SOC 2 Type II

Targeting Q2–Q3 2027. We have engaged an audit firm for SOC 2 Type II. This is a planned roadmap milestone and not a statement of current status.

Responsible disclosure

Report an issue

If you believe you have found a security issue, email security@phlebas.finance. We will acknowledge and respond to good-faith reports promptly.