Security
Madhouse Wallet is built on a security-first architecture. This section covers encryption, key management, authentication, and infrastructure controls.
Summary
Data at rest
AES-256-GCM encryption
Data in transit
TLS 1.2+ on all API traffic
Signing keys
AWS KMS — keys never leave the HSM
API key storage
SHA-256 hash only — plaintext never stored
API key entropy
128-bit (32-char hex secret)
Response encryption
AES-256-GCM per-session for dashboard users
Webhook verification
RSA-SHA256 signature validation
Dashboard authentication
MFA: email OTP + WebAuthn passkey (two independent factors required)
Infrastructure
AWS us-east-1
Certifications
SOC 2 audit in preparation · GDPR · CCPA
Authentication
The API uses long-lived API keys for server-to-server requests. The dashboard uses multi-factor authentication (MFA): an email OTP verification step followed by a WebAuthn passkey — there are no passwords.
Dashboard login (MFA):
Email OTP — a 6-digit code sent to the registered address confirms email ownership
WebAuthn passkey — biometric or hardware key assertion (Touch ID, Face ID, Windows Hello, YubiKey)
Both factors are required in sequence. This ensures that neither email access nor device possession alone is sufficient to authenticate.
API keys are:
Generated with 128-bit entropy
Stored server-side as SHA-256 hashes only
Shown once at creation — never retrievable
Independently rate-limited per key
Optionally locked to a single IPv4
/32
See API Keys for full details.
Infrastructure
All infrastructure runs on AWS us-east-1. Signing keys for on-chain operations are managed in AWS KMS using secp256k1 key material. Private keys never leave the HSM — all signing operations are executed inside KMS.
Certifications & Compliance
SOC 2 Type II — audit in preparation
GDPR compliant
CCPA compliant
See Compliance for regulatory details.
Last updated
Was this helpful?