Security and operational integrity
Security at Alethena Investment is layered: how you access your account, how value moves, and how we prove that our own records are correct.
Account access
- Passwords are hashed with Argon2id, a memory-hard algorithm designed to resist offline cracking.
- Time-based two-factor authentication (TOTP) is supported and strongly recommended.
- Repeated failed logins trigger rate limiting and lockout.
- Sessions are server-backed and protected against fixation; every state-changing request carries CSRF protection.
Protecting your data
- Sensitive stored data, including payout destinations, is encrypted at rest using libsodium.
- Uploaded identity documents are MIME-validated, stored under non-guessable identifiers, and every access to a document by staff is recorded in the audit log.
Integrity of the record
- The transaction ledger and the audit log are append-only, enforced by the database. No record can be edited or deleted — corrections are new, linked entries.
- Automated reconciliation independently recomputes every balance from its transaction history and flags any divergence.
- All money operations are idempotent: a retry cannot double-credit or double-pay.
Operational controls
- Staff access is governed by role-based permissions; every administrative action is written to an immutable audit trail with actor, timestamp, and before/after state.
- Withdrawals above a configured threshold require review before release.
- Platform-wide emergency controls allow deposits and withdrawals to be paused immediately if a risk is identified.
What you can do
- Enable two-factor authentication.
- Use a unique password not reused on any other service.
- Verify every payout address before saving it.
- Treat any message asking for your password, 2FA code, or seed phrase as fraudulent. Alethena Investment will never ask for these.
- Check that you are on our official website before entering your credentials — type the address yourself rather than following a link from an email or message.
Reporting a security issue
If you believe you have found a vulnerability, or you have received a message impersonating
Alethena Investment, please tell us.
Reach us through the contact page.
We will never ask you to send funds to a "verification", "upgrade", or "unlock" address.
See the engineering behind these controls.