StakrTrust Security Policy

Scope of application

This Security Policy applies to all users of the StakrTrust platform, including registered and unregistered visitors to stakrtrust.com, account holders, partners using API integrations, as well as the company's employees and contractors. The provisions of this Policy apply to all services, products, and features provided under the StakrTrust brand, including the web interface, mobile applications, API, and other means of accessing the platform. By continuing to use StakrTrust services, you confirm that you have read this Policy and agree to its provisions. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Security Philosophy

Our approach to security is built on the principle of defense in depth — a strategy in which multiple independent layers of protection ensure system security even if one layer is compromised. We adhere to the principle of least privilege, whereby each system component has access only to the resources necessary for its functions. The "Zero Trust" concept entails verification of every request regardless of its source. Security is embedded into the product at all stages of development — from design to deployment — in accordance with Security by Design and Privacy by Design principles. We continuously update our security practices in accordance with the latest recommendations of NIST, OWASP, ISO 27001, and industry standards of the cryptocurrency sector. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

Multi-Signature Authorization

All significant cryptocurrency asset transactions require multi-party confirmation using a multi-signature (Multi-Signature, M-of-N) scheme. This means that authorization of a transaction requires the simultaneous consent of multiple independent keys belonging to different authorized individuals or devices. Threshold values for activating multi-signature are established based on the transaction amount: the larger the transaction, the greater the number of signatures required. Private keys participating in the multi-signature scheme are stored in geographically distributed secure vaults, significantly reducing the risk of a single point of failure. This architecture substantially impedes unauthorized transactions even in the event of compromise of individual keys or personnel. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Hardware Security Modules (HSM)

For the storage and processing of cryptographic keys, StakrTrust uses certified Hardware Security Modules (HSMs) — specialized devices that provide physical and logical protection of key material. HSMs generate keys in a secure environment, perform cryptographic operations without exporting keys in plaintext, and are certified to FIPS 140-2 Level 3 or equivalent standards. Any attempt at unauthorized physical access to an HSM activates a key material destruction mechanism (tamper-evident/tamper-responsive). The use of HSMs minimizes the risk of unauthorized extraction of private keys even by privileged system users. Hardware Security Modules are an integral component of our key management system and serve as the foundation for all critical cryptographic operations. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Network Segmentation

StakrTrust's network infrastructure is divided into isolated segments in accordance with DMZ (Demilitarized Zone) and micro-segmentation principles. Publicly accessible services are located in a demilitarized zone and are separated from internal systems by multi-layered next-generation firewalls (NGFW). Critical systems — databases, key management systems, financial processing systems — are isolated in separate network segments with minimal necessary communication rules. All inter-segment connections pass through centralized control and logging points. Regular reviews of firewall rules and network configuration are conducted to timely identify and eliminate excessive permissions. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

DDoS Protection

The StakrTrust platform employs multi-layered protection against Distributed Denial of Service (DDoS) attacks, including traffic filtering at the backbone provider level, a Content Delivery Network (CDN) with globally distributed points of presence, and specialized solutions for mitigating volumetric attacks. Rate limiting is applied at all levels — from network to application — enabling the differentiation of legitimate traffic from attacking requests. Automated anomaly traffic detection systems can identify anomalous traffic in real time and initiate failover to protected scrubbing centers for processing volumetric attacks at the upstream provider infrastructure level. Upon detection of an attack, traffic is automatically rerouted through protected scrubbing centers to cleanse malicious traffic before it reaches target servers. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Redundancy and Recovery

All critical StakrTrust infrastructure is built on the principles of redundancy with no single point of failure (SPOF). Server hardware, network channels, and power systems are duplicated at a minimum N+1 level. Data is replicated in real time between geographically distributed data centers, ensuring rapid service recovery in the event of emergency situations. Disaster Recovery procedures are regularly tested during planned exercises. Data backups are created on a schedule, stored in encrypted form in geographically distributed repositories, and checked for integrity. Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are defined for each critical service and regularly reviewed. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Physical Security

StakrTrust's server infrastructure is housed in Tier III+ data centers with 24/7 physical security, video surveillance, and a multi-level access control system. Access to server rooms is restricted and is only possible after biometric authentication, badge verification, and video identification by an authorized security officer. All visits to server premises are documented, recording the purpose of the visit and entry and exit times. Physical storage media are destroyed upon decommissioning in accordance with certified procedures that preclude data recovery. We conduct regular physical security inspections of equipment and the perimeter of secured facilities. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Encryption in Transit

All connections between clients and StakrTrust servers are protected by TLS (Transport Layer Security) version 1.3 — the most current and secure version of the standard. The use of outdated protocols (SSL, TLS 1.0, TLS 1.1) is strictly prohibited at all entry points. The HTTP Strict Transport Security (HSTS) header is enabled for all stakrtrust.com domains, preventing browsers from establishing unprotected connections. Certificate Pinning is applied for critical connections in mobile applications, significantly reducing the risk of successful Man-in-the-Middle (MITM) attacks involving TLS certificate substitution. All TLS certificates are issued by trusted certificate authorities, are regularly renewed, and are monitored for timely renewal. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Encryption at Rest

All user data stored in StakrTrust's databases and file systems is encrypted using the AES-256 algorithm (Advanced Encryption Standard with a 256-bit key) — the industry standard for symmetric encryption. Databases use Transparent Data Encryption (TDE) at the storage level, providing data protection even in the event of physical removal of storage media. Backups are also stored in encrypted form using separate backup encryption keys. Encryption is applied at all storage levels: from block devices and file systems to individual fields in databases containing particularly sensitive information. Access control for encrypted data is ensured by the encryption key management system. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Encryption Key Management

The Key Management System (KMS) in StakrTrust is implemented using Hardware Security Modules (HSMs) for the reliable storage of master keys. Cryptographic keys are classified by criticality level and stored with appropriate protective measures. Encryption keys are subject to regular rotation in accordance with established policies: operational keys are rotated more frequently, and long-term keys follow longer cycles. Secret Sharing is applied to master keys, making unauthorized access by a single individual without the collusion of multiple key-share holders virtually impossible. All key operations are logged in a protected audit journal to ensure full traceability. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Password Storage

User passwords are not stored in plaintext or in reversibly encrypted form. Modern cryptographic hash functions designed for this purpose are used for password storage: bcrypt or Argon2 — winner of the Password Hashing Competition — which are resistant to brute force attacks and rainbow table attacks. Each password is hashed with a unique random salt, making the use of precomputed hash tables impossible. The parameters of hashing algorithms (work factor, memory and CPU usage) are regularly reviewed and updated in accordance with increasing computational power. In the event of a database compromise, an attacker faces substantial difficulty in recovering users' original passwords within a reasonable timeframe. Absolute protection against all possible attack methods is not guaranteed. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

API Key Security

API keys generated for users when integrating with the StakrTrust platform are created using a cryptographically secure random number generator (CSPRNG) and are of sufficient length to protect against brute force attacks. Each API key has a limited set of permissions (scopes) configurable by the user at key creation in accordance with the principle of least privilege. API keys have a limited validity period (TTL) and can be immediately revoked by the user through the personal dashboard. API keys are stored on the platform side in hashed form — analogously to passwords — so that even in the event of a system compromise, the risk of an attacker obtaining active keys is substantially reduced. Users are advised to immediately revoke API keys upon the slightest suspicion of compromise. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

Two-Factor Authentication (2FA)

StakrTrust strongly recommends and encourages all platform users to use Two-Factor Authentication (2FA). Authentication based on Time-based One-Time Passwords (TOTP) is supported through compatible authenticator applications: Google Authenticator, Authy, Microsoft Authenticator, and others. When 2FA is enabled, a one-time confirmation code will be requested for fund withdrawals, changes to security settings, and logins from new devices. Users are strongly advised to save backup recovery codes in a secure location when setting up 2FA — without them, recovering access to the account in the event of loss of the authenticator device is significantly more difficult. Users who have not enabled 2FA assume an elevated risk of unauthorized account access. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

Anti-Phishing Code

Each user can set a unique anti-phishing code — a personal phrase or character sequence that will be included in every official communication from StakrTrust. The presence of your anti-phishing code in a received email confirms that it was genuinely sent by the platform and not by a phishing resource. We strongly recommend setting an anti-phishing code in your account security settings and enabling it immediately. Emails that do not contain your personal anti-phishing code should be treated as potentially fraudulent, and under no circumstances should you follow links contained in them. StakrTrust, as part of standard support procedures, does not request passwords, two-factor authentication codes, or private keys. Any such request should be treated as potentially fraudulent. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Withdraw Address Whitelist

The address whitelist feature allows you to restrict the list of addresses to which funds may be withdrawn from your account to a pre-approved list. After adding a new address to the whitelist, it undergoes a waiting period of 24–48 hours during which Withdraw to that address is not possible. This gives the user time to detect any unauthorized addition of an address by a malicious actor and take protective measures. Any change to the address whitelist (adding, removing) requires 2FA confirmation and submission of a verification email to the registered email address. Using an address whitelist significantly reduces the risk of asset loss in the event of account compromise and is strongly recommended for all users. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Session Management

Active user sessions are tracked by the platform in real time, recording the IP address, browser type and version, operating system, and last activity time. Automatic logout (session timeout) occurs after a period of user inactivity; the exact duration of this period is configurable within established minimum and maximum values. The user can forcibly terminate any active session through the session management section of the personal dashboard, including sessions opened on other devices. IP address binding for sessions is optionally available, whereby a change in IP address during an active session results in its automatic termination. Upon detection of suspicious activity, the platform may forcibly terminate all of the user's active sessions. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

Log in History

Users have access to a complete history of logins to their account, including records of successful authentications and failed Log in attempts. For each event, the following are recorded: date and time (to the second), source IP address, geographic location (country, city), browser or application type and version, and authentication method used. Upon each successful Log in from a new device or unusual location, the user receives a notification to the registered email address. It is recommended that users regularly review their Log in history to detect any unauthorized activity. Log in logs are retained for an established period and are protected against unauthorized modification. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Device Management

The platform supports the maintenance of a registry of the user's authorized devices. Upon first Log in from a new device, verification is carried out via email confirmation and/or 2FA. The user can view the list of all devices authorized to access their account, along with device information, the date of first and last authorization, and the IP address. Each device can be immediately revoked through the personal dashboard, which results in the immediate termination of all sessions from that device and a prohibition on access without re-verification. It is recommended that users regularly review the list of authorized devices and remove devices that are no longer in use. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Password Policy

The StakrTrust platform establishes minimum requirements for user passwords: a length of at least 12 characters, mandatory use of uppercase and lowercase letters, numbers, and special characters. The use of passwords of 16 characters or longer, generated by a password manager, is strongly recommended. The use of passwords that have previously appeared in known data breaches is prohibited — the platform verifies newly created passwords against relevant databases. Users should not use the same password across multiple platforms; the use of a password manager to create and store unique, strong passwords for each service is recommended. Periodic password changes are recommended as an additional security measure, particularly if there is any suspicion of possible compromise. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Account Lockout

To protect against brute force password attacks and dictionary attacks, the StakrTrust platform implements a mechanism for temporary account lockout following multiple consecutive failed authentication attempts. After reaching the established threshold of consecutive failed attempts, account access is temporarily restricted using exponential backoff. The user is notified of the temporary lockout to their registered email with the time at which access will be automatically restored. Early removal of the lockout is possible through an identity verification procedure. This measure is an automatic protection mechanism and does not entail any sanctions for a legitimate user. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Withdraw Delay

When attempting to withdraw funds to an address not included in the whitelist, or upon a first Withdraw from a new device, the platform applies a mandatory waiting period of 24 to 48 hours. This measure gives the user sufficient time to detect an unauthorized Withdraw request and cancel it through the support service. During the waiting period, the user receives notifications about the queued Withdraw request with instructions on how to cancel it. The waiting period does not apply to operations with addresses previously used successfully and whitelisted by the user. The platform reserves the right to extend the waiting period at the security team's discretion when signs of anomalous activity are detected. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

Real-Time Monitoring

StakrTrust's security systems conduct continuous round-the-clock monitoring (24/7/365) of all infrastructure, network traffic, and user activity. A centralized Security Information and Event Management (SIEM) system aggregates and correlates events from multiple sources to enable timely threat detection. Machine learning algorithms analyze activity patterns and identify deviations from normal behavior characteristic of account compromise, insider threats, or external attacks. Threshold values for various classes of security events are regularly reviewed and updated in accordance with the evolving threat landscape. Automated alerting systems immediately notify on-duty specialists of critical events. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

AML/CFT Monitoring

StakrTrust applies automated transaction monitoring systems to detect signs of money laundering (Anti-Money Laundering, AML) and terrorist financing (Countering the Financing of Terrorism, CFT) in accordance with international FATF (Financial Action Task Force) standards. All transactions undergo automatic verification against sanctions list databases, including the OFAC (Office of Foreign Assets Control) list, the UN Security Council list, and lists of other international regulators. Suspicious transactions are automatically suspended for additional review by compliance specialists. Users may be requested to provide additional information on the source of funds or the purpose of a transaction as part of KYC/AML procedures. The platform reserves the right to unilaterally freeze funds or restrict operations when reasonable suspicion of a legal violation arises. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Fraud Detection

StakrTrust's fraud detection system uses behavioral analysis and machine learning methods to identify atypical activity indicative of possible fraud or account compromise. Hundreds of parameters of each transaction and session are analyzed: the user's typical activity hours, usual transaction volumes, geographic patterns, speed of transactions, and many others. Upon detection of anomalies, the system may require additional verification, temporarily block an operation, or alert the security team for manual review. The user may receive a request to confirm an unusual transaction via the registered email or SMS. Continuous improvement of fraud detection models is a priority for our team of specialists. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Incident Response

StakrTrust's Security Incident Response Team (SIRT) operates on a round-the-clock basis and follows formalized response procedures developed in accordance with international standards (NIST SP 800-61, ISO/IEC 27035). Upon detection of a potential incident, a procedure immediately begins to assess its scope, classify it by criticality level, and select the optimal response strategy. Depending on the nature of the incident, containment measures may be applied up to and including the temporary restriction of certain operations or services. All security incidents are thoroughly documented, analyzed after resolution, and the lessons learned are used to improve protective measures. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Audit and Logging

All operations performed on the StakrTrust platform are logged in protected audit journals, forming an immutable chronological audit trail. Audit logs include: user actions, administrative operations, system events, authentication attempts, configuration changes, and transaction history. The integrity of audit logs is ensured by cryptographic methods that preclude unauthorized modification or deletion of records. Logs are retained for the period established by applicable law and internal policies. Access to audit logs is strictly restricted and is provided only to authorized personnel within established procedures. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

SOC - Monitoring Center

StakrTrust's Security Operations Center (SOC) provides continuous monitoring of the security state of the entire platform infrastructure. SOC specialists analyze security event streams, respond to automated alerts, and investigate suspicious activity. The SOC's technology platform includes a SIEM system, endpoint detection and response (EDR) tools, intrusion detection and prevention systems (IDS/IPS), and threat intelligence platforms. SOC effectiveness is regularly assessed using metrics including Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

The StakrTrust platform sends users automatic notifications about security events related to their accounts: logins from new devices or unusual locations, failed authentication attempts, changes to security settings, Withdraw requests, and other significant operations. Notifications are sent to the registered email address and, where appropriate settings exist, via SMS or push notifications in the mobile application. Users can configure security notification settings in the personal dashboard. Upon detection of signs of account compromise, the platform may block access and send the user instructions for restoring account security. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

Penetration Testing

StakrTrust regularly conducts penetration tests (penetration testing) by engaging independent specialized cybersecurity firms. Penetration tests simulate real-world attacker attacks to identify vulnerabilities in applications, network infrastructure, and business processes. Both "black box" tests, in which auditors have only publicly available information, and "gray box" tests with partial system data disclosure are conducted. Each penetration test results in a detailed report listing identified vulnerabilities, their criticality assessment, and remediation recommendations; all critical vulnerabilities are addressed as a priority within the shortest possible timeframe. Penetration test results are used to improve both technical protective measures and secure software development processes. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Vulnerability Scanning

Automated vulnerability scanning is performed on a regular basis using professional static and dynamic analysis tools. All external entry points (IP addresses, domains, API endpoints) are regularly scanned for known vulnerabilities, misconfigurations, and outdated software components. Scanning is performed both on a scheduled basis and ad hoc — when significant system changes are made. Identified vulnerabilities are ranked using the Common Vulnerability Scoring System (CVSS) standard and are remediated according to priorities and established timelines. The Vulnerability Management procedure ensures a complete lifecycle: from discovery to confirmation of remediation. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Source Code Review

All StakrTrust platform code undergoes mandatory security-focused review (code review) through both manual analysis by experienced developers and the application of Static Application Security Testing (SAST) tools. Particular attention is paid to reviewing code that handles user input, performs cryptographic operations, interacts with external systems, and implements authentication and authorization mechanisms. Platform developers undergo regular training in secure software development in accordance with OWASP standards. As part of the CI/CD pipeline, security checks are automatically performed, blocking deployment of code when critical issues are detected. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

Independent Security Audits

Independent security audits of the StakrTrust platform are conducted by specialized organizations with recognized expertise in cybersecurity for financial platforms. Audits cover a wide range of topics: security architecture, implementation of cryptographic mechanisms, incident management processes, physical infrastructure security, and regulatory compliance. Detailed reports with recommendations are produced as a result of audits, the implementation of which is monitored by the internal security team. StakrTrust regards independent audits as an integral element of the security assurance program and strives to engage auditors with international reputations. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

AML/KYC Compliance

StakrTrust implements a comprehensive Anti-Money Laundering (AML) and countering the financing of terrorism program in accordance with the recommendations of the Financial Action Task Force (FATF) and applicable legislation of the jurisdiction of registration. The AML program includes: customer identification and verification procedures (Know Your Customer, KYC), transaction monitoring, screening of clients against Politically Exposed Person (PEP) databases and sanctions lists, retention of transaction records for established periods, personnel training, and designation of an AML compliance officer. Users are obligated to provide accurate information during verification and to promptly notify the platform of any changes. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Personal Data Protection

The processing of users' personal data is carried out in accordance with applicable data protection regulations, including the requirements of the Company's jurisdiction of registration. StakrTrust applies the principles of data minimization, purpose limitation, accuracy, and storage limitation for personal data. Users have rights to access their personal data, correct inaccuracies, and, in cases provided by law, to delete or port their data. Personal data is not transferred to third parties except in cases required by applicable law or necessary for the performance of contractual obligations to the user. Detailed information on personal data processing is set out in the StakrTrust Privacy Policy. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Regulatory Engagement

StakrTrust Ltd. cooperates with competent regulatory authorities in accordance with applicable law requirements, including providing necessary reporting and responding to official requests. The Company may disclose a user's personal data and transaction information without prior notice to the user pursuant to lawful requests from authorized governmental authorities. In cases required by law, StakrTrust is obligated to submit suspicious transaction reports to regulatory authorities. Regulatory engagement is carried out through specially designated Compliance Officers with appropriate qualifications. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Information Security Standards

StakrTrust strives to comply with international information security management standards, primarily ISO/IEC 27001, which defines requirements for Information Security Management Systems (ISMS). Our internal policies and procedures are developed with due regard for the best practices set out in ISO 27002 (Code of Practice for Information Security Controls). We also take into account the recommendations of the NIST Cybersecurity Framework, CIS Controls, and cryptocurrency industry-specific guidelines. Striving for compliance means applying a systematic approach to information security, including regular risk assessments, change management, and continuous improvement. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Protection of Account Credentials

The User bears exclusive responsibility for the confidentiality of their account credentials: password, two-factor authentication codes, backup recovery codes, and any other information that permits access to the account. Account credentials must not be disclosed to anyone, including individuals purporting to be StakrTrust employees: platform staff do not request a user's password or two-factor authentication code as part of standard support procedures. A reliable password manager is strongly recommended for password storage. 2FA codes should be generated only on the user's personal device and must not under any circumstances be disclosed to third parties. At the slightest suspicion of credential compromise, the user must immediately change their password and notify the support service. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

Two-Factor Authentication

The use of two-factor authentication is a strong recommendation for all StakrTrust platform users and substantially reduces the risk of unauthorized account access. Users who have not activated 2FA assume a significantly elevated risk of account compromise; StakrTrust is not liable for losses incurred due to the absence of enabled two-factor authentication. Backup recovery codes must be saved in a secure location separate from the primary authentication device: loss of both backup codes and the authenticator device simultaneously can substantially complicate the account access recovery procedure. The use of SMS authentication as the sole second factor is not recommended due to known vulnerabilities of this method (SIM-swapping attacks); TOTP applications or hardware security keys are preferred. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

Protection Against Phishing

The User is obligated to exercise heightened vigilance against phishing attacks — attempts by malicious actors to steal account credentials using fake websites, email messages, or messaging applications. Before entering account credentials, always verify the browser address bar: the official platform website is accessible exclusively at stakrtrust.com with a valid SSL certificate. Do not follow links from emails, messaging apps, or social networks — instead, type the website address manually or use saved bookmarks. Official StakrTrust emails contain your personal anti-phishing code — its absence indicates that the email is likely fraudulent. StakrTrust bears no liability whatsoever for damages caused as a result of the user visiting phishing websites or providing their data to fraudsters. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Device Security

When working with the StakrTrust platform, users should use only trusted devices with current software: timely-installed updates for the operating system, browser, and antivirus software. It is strongly not recommended to access the platform from devices that may be infected with malicious software, compromised by third parties, or operating in jailbreak/root mode. Screen lock with a reliable PIN code, password, or biometric authentication should be applied to all devices used to access the platform. Loss or theft of a device used to access the platform requires immediate action: password change, device revocation via the session management panel, and notification of the support service. The platform is not liable for damages caused by compromise of the user's device. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Network Connection Security

Using public and unsecured Wi-Fi networks for conducting financial transactions on the StakrTrust platform carries significant risk and is not recommended. On public networks, a malicious actor can intercept traffic, conduct Man-in-the-Middle attacks, and steal account credentials. If the use of a public network is unavoidable, always use a reliable VPN service with traffic encryption from your device to the VPN server. Prefer mobile data (4G/5G) over public Wi-Fi networks when conducting financial transactions away from home. StakrTrust bears no liability whatsoever for damages caused by the user's use of unsecured or compromised networks. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

Reporting Suspicious Activity

The User is obligated to immediately notify the StakrTrust platform of any suspicious activity in their account or any circumstances that may indicate its compromise. This includes: detection of unfamiliar transactions or operations, notifications of logins from unfamiliar devices or locations, receipt of suspicious messages from individuals purporting to be platform staff, and any technical anomalies in account operation. Timely notification enables minimization of potential damage and is a mandatory condition for consideration of any possible compensation claims. Delay in notification may substantially reduce the possibilities for remediation. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

Prohibition on Access Sharing

Transfer of access to a StakrTrust account to third parties is strictly prohibited and constitutes a violation of the Terms of Service. This applies to all forms of access transfer: disclosing the password, providing access to a device with an active session, sharing API keys with full permissions, or any other method of delegating account management. The use of automated bots, scripts, or software to interact with the platform other than through the official API in compliance with established limits is prohibited without the explicit written consent of StakrTrust. The User bears full responsibility for all actions taken in their account, regardless of who performed them. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

API Key Security

API keys must be kept in strict confidence and must not under any circumstances be disclosed to third parties, published in open code repositories (GitHub, etc.), or included in client-side code accessible to end users. When generating API keys, they should be granted the minimum necessary permissions (scopes) sufficient for the specific task, in accordance with the principle of least privilege. Generated API keys should be regularly rotated, particularly whenever there are any changes in the personnel who have access to them. At the slightest suspicion of API key compromise, it must be immediately revoked via the management panel and a new one generated. Losses arising from unauthorized use of API keys due to improper storage are the User's responsibility. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Compromise Due to User Fault

The Company bears no liability whatsoever for any losses, misappropriation of funds, unauthorized transactions, or other damages arising from the compromise of a user's account credentials due to the user's own fault or negligence, to the maximum extent permitted by applicable law. Cases of compromise attributable to the user include, without limitation: use of a weak or reused password; storage of passwords or 2FA codes in insecure locations (text files, cloud notes, messaging apps); voluntary or negligent disclosure of account credentials to third parties; installation of malicious software on a device used to access the platform; failure to follow the recommendations of this Security Policy. The User assumes all financial and other risks associated with inadequate account security. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Phishing and Fraudulent Websites

The Company bears no liability whatsoever for losses incurred by the user as a result of interaction with phishing websites, clones of the official stakrtrust.com website, fake mobile applications, or fraudulent messages purporting to be official StakrTrust communications, to the maximum extent permitted by applicable law. The responsibility for verifying the authenticity of visited websites, received emails, and applications lies solely with the user. The platform publishes official communication channels and provides verification tools (anti-phishing code, DKIM/DMARC email signatures), but cannot guarantee that users will make use of these tools. StakrTrust makes reasonable efforts to block phishing resources but does not control the actions of third parties and is not liable for their unlawful activities. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

Unauthorized Third-Party Access

The Company bears no liability whatsoever for losses arising from the user granting access to their account to third parties — whether voluntarily, under duress, or negligently — to the maximum extent permitted by applicable law. The User bears full responsibility for all operations conducted in their account by any individual who gained access to it with the user's knowledge or through the user's fault. This includes, in particular: disclosing the password or 2FA code to third parties, providing physical access to a device with an active session, and using third-party services to which account credentials were provided. The Company is not obligated to verify who actually logged into an account and may assume that all actions in an account were performed by its legitimate owner. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Use of Unsecured Networks

The Company bears no liability whatsoever for losses arising from the user's use of unsecured, public, or compromised networks to access the StakrTrust platform, to the maximum extent permitted by applicable law. Users who knowingly or unknowingly use networks with insufficient protection levels (public Wi-Fi, unencrypted networks, corporate networks with aggressive proxy servers) independently assume all risks associated with traffic interception, Man-in-the-Middle attacks, and other network-level threats. The recommendation to use a VPN when working on public networks is a strong advisory and not a security guarantee: the Company is not liable for the quality of third-party VPN services. The user acknowledges that these measures must be assessed together with KYC/AML obligations, anti-fraud restrictions, reserve-protection logic, and the platform’s right to take preventive, restrictive, and investigatory action whenever deemed operationally prudent.

Malicious Software

The Company bears no liability whatsoever for losses arising from the presence of malicious software on the user's device — viruses, trojans, keyloggers, ransomware, spyware, or other malicious programs — that resulted in the compromise of account credentials, unauthorized account access, or other damages, to the maximum extent permitted by applicable law. Responsibility for maintaining adequate device protection rests solely with the user: the use of licensed antivirus software, timely installation of updates, and refraining from downloading software from untrusted sources constitute minimum necessary measures. The platform is unable to detect malicious software on a client's device and is not liable for consequences caused by its presence. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Force Majeure

The Company bears no liability whatsoever for losses arising from events beyond the Company's reasonable control, including without limitation: large-scale cyberattacks on critical internet infrastructure; software supply chain compromise by third parties; actions of governmental authorities, including asset requisition, freezing of assets, or internet shutdown; natural disasters, technological catastrophes, and pandemics; systemic vulnerabilities in blockchain network protocols on which the platform operates; and other force majeure circumstances. The Company makes reasonable efforts to minimize the consequences of such events but does not guarantee full protection against their impact and is not liable for losses caused by them, to the maximum extent permitted by applicable law. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.

Absence of Security Guarantees

Notwithstanding the application of an extensive set of technical and organizational security measures, the Company does not and cannot guarantee absolute protection of the platform from all possible threats, attacks, or vulnerabilities. Information security is a field in which threats are constantly evolving, and no system can be considered completely invulnerable. The description of security measures in this Policy is informational in nature and does not create contractual obligations for the Company to guarantee a specific level of protection. All formulations such as "we apply", "we strive", "we use" describe the Company's current practices and do not constitute guarantees of results. By accepting the terms of use of the platform, the User confirms their understanding that holding cryptocurrency assets on any platform carries risks that cannot be fully eliminated. For the avoidance of expansive interpretation, the existence of any control, log, mechanism, or procedure shall not be understood as an unconditional undertaking by the platform to prevent every incident, reverse every loss, or neutralize all consequences of compromise in a distributed digital environment.

Limit of liability

To the maximum extent permitted by applicable law, the Company's aggregate liability to the User for all claims related to this Security Policy or events related thereto is limited to the lesser of the following amounts: the value of assets directly lost due to the Company's fault, which must be demonstrated by the user; and fees actually paid by the user to the Company in the three months preceding the incident. The Company is not liable under any circumstances for indirect, incidental, special, punitive, or consequential damages, including lost profits, reputational harm, or data loss, even if the Company has been advised of the possibility of such damages. These limitations apply to the extent permitted by applicable law and do not affect consumers' inalienable statutory rights under the legislation of the user's jurisdiction. Any such measure is implemented not as an absolute guarantee of outcome, but as one element of a layered defense-in-depth model used by StakrTrust to protect user accounts, reserve liquidity, Withdraw routes, and the surrounding operational perimeter.