> For the complete documentation index, see [llms.txt](https://docs.madhousewallet.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.madhousewallet.com/security.md). # Security Madhouse Wallet is built on a security-first architecture. This section covers encryption, key management, authentication, and infrastructure controls. *** ## Summary | Control | Implementation | | ---------------------------- | -------------------------------------------------------------------- | | **Data at rest** | AES-256-GCM encryption | | **Data in transit** | TLS 1.2+ on all API traffic | | **Signing keys** | AWS KMS — keys never leave the HSM | | **API key storage** | SHA-256 hash only — plaintext never stored | | **API key entropy** | 128-bit (32-char hex secret) | | **Response encryption** | AES-256-GCM per-session for dashboard users | | **Webhook verification** | RSA-SHA256 signature validation | | **Dashboard authentication** | MFA: email OTP + WebAuthn passkey (two independent factors required) | | **Infrastructure** | AWS us-east-1 | | **Certifications** | SOC 2 audit in preparation · GDPR · CCPA | *** ## Authentication The API uses long-lived API keys for server-to-server requests. The dashboard uses **multi-factor authentication (MFA)**: an email OTP verification step followed by a WebAuthn passkey — there are no passwords. **Dashboard login (MFA):** 1. Email OTP — a 6-digit code sent to the registered address confirms email ownership 2. WebAuthn passkey — biometric or hardware key assertion (Touch ID, Face ID, Windows Hello, YubiKey) Both factors are required in sequence. This ensures that neither email access nor device possession alone is sufficient to authenticate. API keys are: * Generated with 128-bit entropy * Stored server-side as SHA-256 hashes only * Shown once at creation — never retrievable * Independently rate-limited per key * Optionally locked to a single IPv4 `/32` See [API Keys](/quickstart/api-keys.md) for full details. *** ## Infrastructure All infrastructure runs on **AWS us-east-1**. Signing keys for on-chain operations are managed in **AWS KMS** using secp256k1 key material. Private keys never leave the HSM — all signing operations are executed inside KMS. *** ## Certifications & Compliance * **SOC 2 Type II** — audit in preparation * **GDPR** compliant * **CCPA** compliant See [Compliance](/introduction.md) for regulatory details.