Platform Security
Non-custodial by design
The platform never receives private keys, seed phrases or wallet passwords. Only public addresses are stored, for read-only monitoring.
Server-side authorization
Every data access runs through authenticated server functions with row-level security scoped to the account owner. Administrative endpoints verify the admin role server-side.
Audit logging
Sign-ins, license changes, wallet changes and administrative actions are recorded as security events on the account.
Transport and secrets
All traffic is HTTPS-only. API secrets and service credentials are held server-side and are never exposed to browser code.
Responsible disclosure: report vulnerabilities to support@zurutechnologies.com.