DUALKEEPSecurity at DUALKEEP
How funds are protected
Per-invoice addresses
Every invoice gets its own deposit address derived from the platform treasury, so payments are isolated, attributable, and never commingled at the address level.
Cold storage by default
Deposits are swept on a schedule and the bulk of platform funds is moved to cold storage. Hot operating balances are kept deliberately lean and monitored against a hard threshold.
Continuous reconciliation
An automated process continuously compares on-chain holdings against the sum of all merchant balances. Any shortfall triggers an immediate alert - solvency is checked by software, not by promises.
Encrypted key material
Wallet seeds and secrets are encrypted at rest with AES-256-GCM. Production access is restricted, and secrets never appear in logs or client-side code.
Platform security
- TLS everywhere. All traffic to dualkeep.com and the API is encrypted in transit.
- Signed webhooks. Every webhook is signed with a per-merchant HMAC-SHA256
secret (
X-CryptoGate-Signature) plus a timestamp signature for replay protection, so your server can verify each notification really came from us. - Hardened sessions. Dashboard sessions use HttpOnly cookies, CSRF protection on every form, and rate limiting on authentication endpoints against brute force.
- Least data. We collect no card numbers and minimal personal data - see the privacy policy. There is simply less to steal.
- Finality without chargebacks. Blockchain settlement removes the fraudulent-reversal attack surface that plagues card processing.
Buyer protections
- Checkout pages show the exact amount, address, and network, with QR codes to eliminate copy-paste errors.
- Assets that require a destination tag or memo (XRP, XLM, TON) are flagged prominently - payments are only credited when they can be attributed correctly.
- Rate windows are explicit: the price a buyer sees is honored for the displayed window, with an optional fix-price lock.
Reporting a vulnerability
If you believe you have found a security issue in DUALKEEP, email [email protected] with "Security" in the subject. We read every report, respond quickly, and will not take legal action against good-faith research that avoids privacy violations and service disruption.