Executive Summary

Robust multi-layered security designed for enterprise scale.This document includes a high-level overview of our information security and policies. Our software is designed with security as a core principle and it is built directly into the foundation of our products from day one.  We have worked closely with top-rated security auditors such as NCC Group and Kudelski Security who conducted a series of security code analyses and pen-testing to ensure our product is secure. Laika Compliance has also audited our operational controls to verify that we comply with the strict requirements of SOC II.

Our infrastructure is hosted on AWS in the EU-West (Ireland) region, which provides robust physical security and compliance with EU data protection regulations. Our IT controls include: restricted access to data is on a “need to know” basis, end-to-end encryption for storage and transmission across all systems, a “release management process” for any software releases, incident management processes, highly available cloud resources, and additional policies, controls, and safeguards described below in this document. We have a strong commitment to transparency and accountability. All of our controls, and policies have been audited and certified for SOC II Type 1 compliance, with periodic testing to ensure ongoing effectiveness.

Additionally, our software undergoes regular [1] security audits and penetration testing by independent experts from NCC Group and Kudelski Security. These audits help io.finnet stay at the forefront of security best practices in the industry.

We have implemented comprehensive data privacy compliance documentation and have appointed a Data Protection Officer to oversee the exercise of users' data privacy rights. Changes to the software, including maintenance activities, are managed in accordance with our SOC II release management process to ensure minimal disruption.

Overall, io.finnet's robust security measures, combined with its commitment to regular audits and compliance, make it a trusted, secure, and reliable platform that meets and exceeds industry standards.

[1] We engage with accredited third-party auditors for a comprehensive review every 12 - 24 months.
TECHNOLOGY & INFRASTRUCTURE
Tech architecture
io network: We have adapted the popular open-source project Quorum, a permissioned blockchain platform that is fully EVM compatible. It has been extensively audited and used in production by many organizations, including JP Morgan, making it one of the most secure and battle-tested blockchain platforms available.

Key features:
• EVM-based smart contracts: the network uses an Ethereum Virtual Machine (EVM) to execute smart contracts, which are tamper-proof and self-verifying. This makes them highly resistant to tampering and fraud.
• Permissioned and private: Transactions settled on the network  are encrypted at rest and in transport, they are accessible by the principal member (you) operating the software.
• Strong cryptographic guarantees: The network employs advanced cryptographic techniques, including Merkle trees and secure hashing, to ensure the integrity of the blockchain. Once a block is added to the chain, its contents cannot be altered without invalidating the entire chain.

Specific Tools
AWS, Cognito, Vercel, RDS, DynamoDB, Typescript, Go.
Secutiry infrastructure
Infrastructure overview
• All infrastructure is deployed as code using Terraform, CloudFormation, and the Serverless Framework, ensuring uniform configuration.
• Changes to the production environment are reviewed by at least two engineers and require approval from key stakeholders.
• Secrets are centrally stored and encrypted using AWS Secrets Manager with RBAC, auditing, and automatic rotation.
• Security events are logged and monitored via AWS services like IAM and CloudTrail.
• The production network is segmented into secure zones with controlled access.
• All network traffic over public networks is encrypted.
Specific Tools
Terraform, CloudFormation, Serverless Framework for IaC. AWS Secrets Manager for secrets management.
AWS IAM, CloudTrail, and other AWS security services for logging and network security.
Cryptography
Cryptographic frameworks used to secure data:
• TLS 1.2+ to secure data in transit,
• AES-256 with AWS KMS for data at rest,
• and bcrypt with salting for password storage. This is provided by AWS Congito which handles client authentication.
Custom MPC TSS is used for transaction signing, audited both publicly and privately.
All sensitive information is encrypted both during transmission and when at rest. The encryption at rest is secured by Apple's Secure Enclave. The FIPS-140 level 2 certified HSM is isolated from the main processor to provide an additional layer of security, and it is specifically designed to keep sensitive user data secure. In the Virtual Signer, we utilize Intel SGX technology. During transmission, we employ hardened TLS and end-to-end asymmetric encryption.
Key Management
AWS KMS is used for centrally managing cryptographic keys with controls for deletion, access, and rotation.
Specific Tools
AWS KMS for key management. TLS, AES-256, bcrypt, and MPC TSS for cryptographic frameworks.
AUDITS & CERTIFICATIONS
NCC GROUP
Application Code Review performed by NCC Group in June 2022
Audit Summary:
NCC Group conducted a comprehensive security assessment of iofinnet's application using industry-standard methodologies and proprietary tools. io.finnet demonstrated a strong commitment to security by proactively providing full access to the source code and documentation.
The assessment identified a few opportunities for improvement, including one medium severity vulnerability, three low severity vulnerabilities and two informational findings, which io.finnet promptly addressed upon completion of the assessment. A follow-up confirmed that all vulnerabilities had been fully remediated within the specified timeframe. To note that no severe vulnerability has been identified.
The findings from this audit help io.finnet proactively adapt to the latest industry standards.
NCC Group remains available to provide further consultation and support as io.finnet continues to enhance the security of its io.vault application.
KUDELSKI SECURITY
Application Code Review performed by NCC Group in June 2022
Audit Summary:
Kudelski Security conducted a comprehensive code audit of io.finnet's TSS library, implementing the "UC Non-Interactive, Proactive, Threshold ECDSA with Identifiable Aborts" threshold signature scheme. The audit aimed to provide a professional opinion on the maturity, adequacy, and efficiency of the software solution, check compliance with existing standards, and identify potential security or interoperability issues with recommendations for improvement. The audit identified a total of 2 High, 6 Medium, 8 Low, and 15 Informational findings which have been remediated ensuring io.finnet is above industry standards. The findings and remediations were also publicly disclosed following the ‘responsible disclosure’ process to other similar libraries implementing Threshold ECDSA.
Importantly, no evidence of hidden backdoors or malicious intent was found in the code. The library, originally a fork of Binance's tss-lib, demonstrates io.finnet’s commitment to leveraging established security standards. During this audit, io.finnet and Kudelski Security worked together to reveal vulnerabilities in the TSS protocol (EDDSA and EdDSA schemes) used in various programming languages like Go and Rust. io.finnet and Kudelski partnered with the MPC Alliance to ensure all actors in the ecosystem were aware of the security breach before disclosing it, preventing millions of MPC user assets from being put at risk (Read Article LINK).
The findings from this audit ensure io.finnet stays at the forefront of best security practices in the industry.
Kudelski Security remains available to provide further consultation and support as io.finnet continues to enhance the security of its TSS library.
SOC2 TYPE 1
‍Completion of SOC 2 Type 1 audit by Thoropass/Laika, January 2024
Certification Summary:
The SOC 2 Type 1 audit specifically focuses on managing customer data based on five trust principles: security, availability, processing integrity, confidentiality, and privacy. io.finnet successfully completed this audit, demonstrating their commitment to these principles and to data security.
Laika assisted io.finnet in the audit process, reviewing their systems, controls, policies, vendors, and conducting testing and auditing to ensure compliance. This thorough examination led to the successful completion of the audit.
io.finnet is planning to achieve SOC 2 Type 2 certification, by the end of 2024.
SOLUTION ARCHITECTURE
Data & Access
Physical Location
AWS eu-west (Ireland).
 
Access Controls
Data access is restricted by our access control policy on a “need to know” basis and according to the degree of confidentiality and/or sensitivity of the Data.
 
Encryption
All systems use end-to-end encryption for transit and storage, adhering to best IT practices.
 
Authentication
Our password policy includes complexity requirements and hashing via Google Business SSO.
SOFTWARE SUPPLY CHAIN
Secure SDLC
We incorporate security into every phase of the SDLC with training, code reviews, dependency scanning, DevSecOps, RBAC, incident response, and regular audits.
 
Deployment Processes
Over 80% of production code is covered by automated tests.
We use a staging system to validate builds before deployment to production.
 
Dependency Management
We maintain a bill of materials for critical dependencies and monitor vulnerabilities using tools like Dependabot.
 
Outsourced Development
We use some open source projects and perform security reviews like pen-testing and code assessments.
 
Specific Tools
GitHub code scanning for static analysis.
Dependabot for dependency scanning.
Various tools for DevSecOps, testing, and auditing.
Proactive Security
Vulnerability Management Overview
We use automated tools including AWS GuardDuty and Dependabot for vulnerability scanning and dependency checks.
Vulnerabilities are classified, prioritized, and remediated within 1-2 business days.
Real-time monitoring, continuous code review, and third-party audits ensure ongoing security.
All processes are documented for compliance and auditing purposes.
 
Specific Tools
AWS Inspector, GuardDuty, and IAM for network and infrastructure vulnerability management.
Dependabot, CVE feeds, and GitHub CI/CD for application dependency and code vulnerability detection.
 
Security Awareness Program
New hires receive security orientation/Onboarding Training. Monthly Webinars with updates on security trends and policies via Braintrust. Regular mock attack simulations. Annual Assessment with Security awareness Tests and training plan review.
 
Responsible Disclosure
We have a responsible disclosure policy at security@iofinnet.com.
 
Production Patching
Patches are evaluated in real-time through subscriptions and regular reviews.
Updates are applied within 1-2 business days of identification.
 
Endpoint Security Overview
We use a WAF, reverse proxies, rate limiting, code reviews, and penetration testing to mitigate web application vulnerabilities.
AWS GuardDuty, AWS WAF, and AWS CloudTrail are used for breach detection with real-time alerts to key stakeholders.
 
Specific Tools
AWS GuardDuty, AWS WAF, and AWS CloudTrail for breach detection and anomaly detection.
Reactive Security
Threat Intelligence
We stay aware of potential threats through continuous monitoring of threat feeds, CVE alerts, and collaboration with industry groups like the MPC Alliance.
Regular audits and scans by our dedicated security team help identify vulnerabilities.
 
Monitoring
Centralized logging with Sentry, CloudWatch, and Loki collects network and application logs.
Automated real-time analysis triggers alerts, which are escalated based on criticality.
 
Incident Response
Our response follows a structured process: identification, containment, eradication, recovery, and lessons learned.
Testing through tabletop exercises and simulated attacks ensures readiness.
An annual review keeps the plan current.
 
Incident Communication
We have defined criteria and SLAs for notifying clients promptly in the event of an impact.
Notification times range from 2 business hours to 2 business days, depending on the severity of the incident.
 
Specific Tools
Sentry, CloudWatch, Loki for centralized logging.
MPC Alliance for threat intelligence collaboration.
INTERNAL SECURITY PROGRAM
io.finnet also has an organizational structure that establishes, approves, implements, and monitors adherence to an Information Security Program through clear lines of authority and responsibilities. Contact us to learn more about io.finnet Internal Information Security Policy.
BASIC COPYRIGHT NOTICE & DISCLAIMER
© 2021 This presentation is copyright protected. All rights reserved. You may download or print out a hard copy for your private or internal use. You are not permitted to create any modifications or derivatives of this presentation without the prior written permission of the copyright owner.
This presentation is for information purposes only, the opinions expressed in this presentation are solely those of Io FinNet and do not necessarily reflect the views of any third party. All statements made in this presentation are believed to be true and accurate at the time of publication, however, Io FinNet makes no representations or warranties of any kind, express or implied, regarding the completeness, accuracy, reliability, or suitability of the information provided. No reliance should be placed on the information provided herein without independent verification. Any decisions made based on the information presented here are at your own risk. In no event will Io FinNet be liable for any loss or damages of any kind, including any direct, indirect or consequential damages arising out of or in connection with the use of this presentation.