The application can ask
The compromised credential is used to submit a request. Submitting it does not grant authority to execute it.
AlphaPoint Cloud
An attack is a matter of when. Decide now what it can reach.
Explore AlphaPoint Cloud’s design for hardware-isolated keys, configurable policies, named approvers and signed records. Discuss how these controls could fit treasury, trading, payments or your own applications.
See how it worksStart with a 30-minute conversation about your priorities and AlphaPoint Cloud’s security controls. A deeper technical session can follow.
Illustrative threat scenarios.
Hypothetical examples of how the core’s controls are designed to address common security risks.
A key gets copied.
Vault
Hardware-isolated key generation and use are designed to keep private keys out of the application.
A credential gets phished.
Approvals
Approval policies can require named approvers before a sensitive action proceeds.
One person acts alone.
Approvals
Named approvers and recorded decisions can support separation of duties for transfers, signing and configuration changes.
A server gets compromised.
Protected compute
Hardware-isolated compute is designed to separate sensitive logic from the rest of the application stack.
Someone demands proof.
Ledger
Signed request, decision and result records are intended to support audit, regulatory and incident review.
Illustrative protected boundary
An illustrative view of the intended boundary controls, using hypothetical traffic and destinations.
AlphaPoint Cloud
A common path for sensitive actions.
AlphaPoint Cloud is designed to combine policy checks, named approvals, hardware-isolated key operations and signed records. Discuss the architecture and control scope with our team.
Vault
Designed to sign and encrypt for applications while keeping private keys isolated.
Approvals
Policy checks and named approvers are designed to control which requests proceed to execution.
Ledger
Designed to provide signed, exportable records of requests and approval decisions.
Protected compute
Designed to run sensitive logic in hardware-isolated environments, separated from the application stack.
Illustrative record verification
A hypothetical comparison of exported rows and a signed receipt, illustrating the verification mechanism.
Scroll to view the full diagram.
Illustrative scenario
A stolen credential. A transfer that still needs approval.
Imagine an attacker obtains a payment application’s credential and submits a transfer request. In this example, the organization has configured the transfer to require approval from named people. The attacker has the application credential, but none of those approvals.
Required approvals are missing
The request reaches the policy and approval checks. Without the required approvals, it does not proceed to execution.
The signing key stays outside the application
Vault keeps the key in hardware. The application requests its use without holding the key itself.
Illustrative approval on a separate display
Illustrative review of an authorized request. The device shown is a design, not a shipped unit.
Separate the ability to request an action from the authority to execute it.
Hypothetical scenario illustrating the intended control model. No customer deployment or real-world result is represented.
Request a 30-minute Security BriefingSee how it worksIllustrative applications.
Hypothetical applications for custody, payments, trading, liquidity and custom software. Explore how the shared key, approval and record controls could fit your requirements.
Payments and transfers
Stablecoin payouts and settlement, run like institutional cash.
Treasury platformTrading and execution
Digital asset markets at scale, with the governance regulated markets require.
Trading platformYour own applications
Explore how your team’s applications could use policy-controlled services.
AlphaPoint CloudSomething else?
Have another application in mind? Tell us what you are building and the security controls you need.
Talk to teamCustody and treasury
Balances across wallets, chains and entities. Payouts, approvals and reconciliation.
Treasury platformWhat we can show you.
Evidence, stated as narrowly as it is true. Detailed material can be reviewed in a follow-up under NDA.
Formal verification
Selected properties, stated assumptions
We use formal verification for specified properties of selected components, under stated assumptions. This is not a proof of the whole platform.
Compliance
Ask for current status
Certification and audit status changes over time. Ask us for the current position rather than relying on a list on this page.
Technical evidence
Follow-up under NDA
A 90-minute follow-up with engineering and security can cover architecture, the threat model and verification material under NDA.
Resources.
Browse AlphaPoint’s published articles on digital asset infrastructure.
Before, not after.
The time to put your operations on a secure core is before you have to prove what happened.
Use our inquiry form to request a 30-minute Security Briefing. Your request is prefilled and editable. A 90-minute engineering and security session under NDA can follow. For a product walkthrough, book a demo.