Security & Compliance

Security is infrastructure,
not a feature.

Every layer of DeFlow is designed with security as a first principle — from zero-knowledge identity to non-custodial settlement.

Architecture

Zero-PII by design

DeFlow never stores personal information. Emails, names, and identities are processed through HMAC-SHA256 with a rotating salt — then immediately discarded. Only the irreversible hash is stored.

  • Raw email discarded after HMAC-SHA256 hashing
  • No PII in database, logs, or Sentry error reports
  • ZeroPiiExceptionFilter strips sensitive data from all responses
  • Email notifications via Privy REST API — backend never sees email strings
User Emailuser@example.com
↓ HMAC-SHA256
Stored Hasha7f8c3e2d...
↓ Discard
Raw Emailuser@example.com
Smart Contracts

Audited & battle-tested

Our Solidity contracts are verified through multiple layers of automated and manual analysis.

🔍

Slither Analysis

Static analysis for common Solidity vulnerabilities, reentrancy, and gas optimization issues.

🧪

Foundry Fuzz Testing

Property-based fuzz testing with millions of random inputs to find edge cases.

📐

Formal Verification

Mathematical proofs for critical invariants in escrow and fee distribution contracts.

🔒

Access Control Audit

OpenZeppelin-based role separation with multi-sig requirements for administrative functions.

Compliance

Sanctions screening & KYC

Every participant is screened against international sanctions lists before any transaction is allowed to proceed.

  • OFAC / EU / UN / OFSI / MOFA / NBCTF screening
  • Wallet screening via Scorechain (Web3 AML)
  • 24-hour TTL on AML results — stale data blocks funding
  • 3-tier KYC: Basic → Enhanced → Corporate
🛡️
OFACEUUNOFSIMOFANBCTF
Active Screening
Settlement

On-chain finality

Non-custodial smart escrow with deterministic settlement.

⛓️

Non-Custodial

DeFlow never holds your assets. Smart contracts manage escrow with deterministic release conditions.

⏱️

6-Block Finality

All transactions confirmed with 6-block depth on Ethereum (Sepolia in staging, 1-block on Anvil).

📊

Event Reconciliation

On-chain events are immutable financial truth. UI confirms only after chain event verification.

🐛

Bug Bounty Program

Found a vulnerability? We take security seriously and reward responsible disclosure.

Coming Soon