Security built for institutional trust.

The majority of client assets are held in air-gapped cold storage wallets — physically isolated from any internet-connected system. Private keys are generated and stored on hardware security modules (HSMs) in geographically distributed, access-controlled facilities.

• HSM-based key generation and storage
• Air-gapped signing environment
• Geographic distribution across secure vaults
• Periodic on-chain audit verification

All outgoing transactions require multiple independent cryptographic signatures from key custodians distributed across different geographic locations. No single point of failure or single person can authorize a withdrawal unilaterally.

• M-of-N multi-signature threshold signing
• Geographically distributed key custodians
• Time-lock delays on large withdrawals
• Dual-control policy for all key operations

Client assets are held in accounts legally and operationally segregated from QOVA's own treasury. In the event of any operational issue, client funds cannot be used to cover operational liabilities. This structure is mandated by our BCR license.

• Client funds never commingled with operational treasury
• Per-client accounting with daily reconciliation
• Regulatory mandate under BCR framework
• Independent custodian confirmation available on request

Every transaction is screened in real-time against multiple risk signals: behavioral anomalies, velocity checks, blacklisted addresses, and AML scoring. Alerts trigger immediate automated holds pending human review by our compliance team.

• Blockchain address screening (sanctions + known bad actors)
• Velocity and pattern anomaly detection
• Automated hold triggers with manual review
• 24/7 on-call compliance officer

Every transaction settled through QOVA is permanently recorded on-chain — on Tron (TRC-20) or Ethereum (ERC-20). The record is public, immutable, and verifiable by any counterparty at any time. This eliminates any risk of record falsification.

• TxHash provided for every settled transaction
• Public blockchain verifiability
• Tamper-proof immutable record
• Queryable via standard block explorers

All platform access requires strong multi-factor authentication. API keys are scoped with least-privilege permissions. IP whitelisting, withdrawal address whitelisting, and session anomaly detection are enforced at every layer.

• Mandatory 2FA for all accounts
• API key scoping with IP whitelisting
• Withdrawal address whitelisting
• Session fingerprinting and anomaly detection