Trust, engineered into every layer.
Plutope is non-custodial by architecture and regulated by partnership. Funds remain provably yours; movement is governed by licensed counterparties, hardware-backed key management, and continuous third-party audit. Below is the same dossier we share with banks, auditors, and institutional partners.
- 0
- Customer funds held by Plutope
- 100%
- Keys generated client-side
- 24/7
- On-call security response
- SOC 2
- Type II in progress
Four commitments that shape every line of code.
These aren't policies. They're architectural constraints — enforced in the codebase, in our vendor selection, and in every partnership we sign.
Non-custodial by default
Private keys are generated and stored exclusively on user devices via Secure Enclave (iOS) and Keystore (Android). Plutope has no operational capability to move user funds. There is no admin override. There is no internal database of seed phrases. There is, by design, nothing to seize, subpoena, or breach.
Regulated by partnership
Where regulated activity is required — card issuing, fiat on/off-ramps, virtual accounts, settlement — Plutope operates exclusively through licensed counterparties: BIN sponsors, EMIs, MTLs, and partner banks across the EU, UK, MENA, and APAC. Each integration carries its own license stack and audit trail.
Verifiable, not promised
Source code for cryptographic primitives is open and reviewable. Smart contracts deployed by Plutope are audited and verified on-chain. Reserve attestations for stablecoin float are published quarterly. Trust is established through verification, not marketing.
Compliance as infrastructure
KYC, KYB, sanctions screening, and transaction monitoring run as first-class systems across every product. We use Sumsub, Chainalysis, and Onfido in production, with internal escalation paths reviewed by a dedicated compliance officer in every jurisdiction we operate.
Four layers. Each independently verifiable.
Key material never leaves the device
- Generation
- BIP-39 entropy from Secure Enclave / Android Keystore
- Storage
- Hardware-isolated; never written to Plutope servers
- Authentication
- Biometric (FaceID / fingerprint) + device PIN
- Backup
- User-controlled iCloud Keychain or encrypted phrase export
Transport hardened end-to-end
- TLS
- TLS 1.3 only, HSTS preload, certificate pinning
- Edge
- Cloudflare WAF, bot management, DDoS mitigation
- API
- OAuth 2.0 + signed requests, mutual TLS for partners
- Egress
- All third-party calls allowlisted and logged
Least privilege, top to bottom
- Access
- SSO + hardware key (YubiKey) for all production access
- Reviews
- Two-person code review, signed commits, branch protection
- Secrets
- Vaulted via HashiCorp; rotated on a 30-day cadence
- Dependencies
- SBOM published, daily SAST/DAST/SCA scanning
Funds flow only through licensed rails
- Cards
- Issued by EU-regulated BIN sponsor (EMI license)
- Fiat
- MTL/EMI partners in IN, AE, SG, EU, UK, US
- Stablecoins
- USDC (Circle), USDT (Tether), with attested reserves
- Reconciliation
- Atomic ledger with double-entry against on-chain proofs
Where we operate, and under whose authority.
- SOC 2 Type IIIn progress · Q3 2026Audited by Big-4 firm
- ISO 27001Gap assessment completeTargeting Q4 2026
- PCI DSSInherited via BIN sponsorLevel 1 service provider
- GDPRCompliantEU DPO appointed; SCCs in place
- CCPACompliantConsumer rights portal live
- DPDP (India)CompliantLocal data residency in IN region
- European UnionCard issuing via EMI-licensed sponsor (Lithuania)
- United KingdomFCA-registered EMI partner for GBP rails
- United Arab EmiratesVARA-compliant VASP partnership (Dubai)
- IndiaPA-PG licensed partner for INR virtual accounts
- SingaporeMAS MPI partner for SGD and cross-border
- United StatesMTL-licensed correspondent for USD settlement
Reviewed by the firms that review the rest of the industry.
| Firm | Scope | Outcome |
|---|---|---|
| Trail of Bits | Smart-contract & cryptographic review | All high-severity findings resolved |
| Halborn | Mobile wallet & key-derivation audit | Zero critical, two informational |
| Cure53 | Web application penetration test | Clean report; published with permission |
| Big-4 firm (in progress) | SOC 2 Type II observation window | Quarterly control attestations available |
Responsible disclosure
We work with the security research community under a public safe-harbor policy. Researchers acting in good faith are protected from legal action and credited at their discretion. Reports are triaged within one business day, with severity, scope, and remediation timeline confirmed within five.
Bug bounty
Plutope operates a private bounty programme on HackerOne, expanding to public in 2026. Payouts follow severity, with critical findings rewarded up to USD 150,000.
The dossier we send to enterprise diligence teams.
Talk to our security team.
Diligence questionnaires, SIG/CAIQ, partner security reviews — we respond within one business day.