Security & operational controls

Ledger as source of truth

Balances are tracked as available, reserved, in-flight, and settled. Routing and settlement reference the ledger — fiat and digital-asset legs are not commingled.

Quote binding

Executable quotes carry server-side TTL. Rate, fee snapshot, and LP routing context bind at acceptance. Expired quotes cannot be paid against. This prevents stale-rate exploitation.

Settlement review

• Quote acceptance reserves inventory on the LP book.
• Fiat capture or payout confirms independently of the crypto leg.
• Crypto send or receive confirms on its rail with ledger updates.
• Order completes only when both legs reconcile or policy closes the fill.
• Ops can hold, decline, or retry without rewriting executed economics.

Permission boundaries

• Customers see only their quotes, orders, wallet, and beneficiaries.
• LPs see only inventory and fills for their lpId — not other desks.
• Ops, compliance, and admin roles are separated with distinct permission sets.
• Public marketing does not expose internal network counters or LP inventory.

Digital-asset handling

• Fiat and digital-asset legs never commingle in the book.
• Reserved balances lock against open quotes before settlement releases.
• Adapter layer supports simulator, testnet, and custody paths — labeled honestly in program docs.

Report a concern

Help & contact for security or abuse reports related to your FIFO program.