# Security Overview

How Aurea protects the wallets, the data and the integrations of your tenant, what you can add on top, and how to report a vulnerability.

## Overview

- **No single point that can move funds.** An MPC wallet signs only with two of its three shares, and Aurea's cosigner keeps one: Aurea cannot sign for your users alone ([MPC Wallet Security](https://docs.aureahub.com/docs/guide-mpc-security.md)).
- **Every request is authenticated.** Your server signs its requests with its credentials; your users act with short-lived access tokens; sensitive actions can ask for a passkey.
- **Your rules run before a signature.** Policies, signing rules, the address book, screening and freezes decide at the points where a wallet would sign.
- **The EU.** The platform runs and keeps its data in the European Union ([Security & Data Residency](https://docs.aureahub.com/docs/guide-data-residency.md)).

## Keys and Wallets

- **MPC wallets**: 2-of-3 threshold signatures — the user's device, the user's backup and Aurea's cosigner each keep one share; the complete key never exists anywhere, not even while it is made or used. [MPC Wallet Security](https://docs.aureahub.com/docs/guide-mpc-security.md) describes the ceremonies, the relay, the approval key, backup and recovery.
- **Non-custodial wallets**: the key stays on the user's device; Aurea receives only the signed transaction.
- **Custodial wallets**: the platform keeps the key for your tenant, always encrypted, in EU regions ([Wallets & Custody](https://docs.aureahub.com/docs/guide-non-custodial-keys.md)).

## Your Integration

- **Server requests are signed** with your credential's secret, a timestamp and the request's body, so a request cannot be altered or replayed ([Authentication](https://docs.aureahub.com/docs/authentication.md)). Rotate secrets on a schedule, and at once if one may have leaked ([Credentials & Rotation](https://docs.aureahub.com/docs/guide-credentials.md)).
- **Server credentials** carry a role that narrows the routes their tokens reach; a credential can be limited to the test networks ([Server Credentials](https://docs.aureahub.com/docs/guide-server-credentials.md)).
- **Users** sign in with short-lived access tokens and refresh tokens; passkeys and a passkey step-up confirm sensitive actions ([Passkeys & Step-Up](https://docs.aureahub.com/docs/guide-passkeys.md)).
- **Webhooks** are signed: verify each delivery's signature before you trust it ([Webhooks & Events](https://docs.aureahub.com/docs/guide-events.md)).
- Requests are rate-limited per caller, and a retry with the same idempotency key never runs an operation twice.

## Your Tenant's Controls

Controls your administrators set, enforced at the points where a wallet would sign or funds would move:

- [Policy Sets & Groups](https://docs.aureahub.com/docs/guide-policy-sets.md) and [Approvals](https://docs.aureahub.com/docs/guide-approvals.md) — limits, allowed destinations and the approvals a payment needs, with your tenant's quorum for changes ([Your Tenant's Quorum](https://docs.aureahub.com/docs/guide-tenant-quorum.md)).
- [Signing Rules](https://docs.aureahub.com/docs/guide-signing-rules.md), the [Address Book](https://docs.aureahub.com/docs/guide-address-book.md), [Screening & AML Cases](https://docs.aureahub.com/docs/guide-screening.md) and [Freezes & Quarantines](https://docs.aureahub.com/docs/guide-freezes.md).
- Your own approval of each signature through an [Institution Callback](https://docs.aureahub.com/docs/guide-institution-callback.md), and the audit trail of every security-relevant action ([Audit Trail](https://docs.aureahub.com/docs/audit-events.md)).
- Which of these your tenant has, and which are recorded or enforced today: [Feature Availability](https://docs.aureahub.com/docs/feature-availability.md).

## Operations

- The platform's services and its cosigner are monitored around the clock, with alerts to Aurea's team; the cosigner runs on more than one node, so one node's failure does not stop signing.
- The database is backed up daily and before every upgrade, in two EU regions, and restoring it is tested.
- Every release is reviewed and verified before deployment, including against your tenant's existing behaviour. A new security control reaches production first in a recording mode, and refuses only once its records show it does not stop legitimate traffic.
- Changes that affect your integration are announced in the [Changelog](https://docs.aureahub.com/docs/changelog.md) and follow the deprecation policy.

## Reporting a Vulnerability

If you believe you have found a vulnerability in Aurea's platform, its API, its apps or these docs, write to [help@aureahub.com](mailto:help@aureahub.com) with "Security" in the subject.

- **Include** what you found, where (route, page or app), the steps to reproduce it, what an attacker could do with it, and how to reach you.
- **Please** test only against your own tenant and your own accounts, preferably in the sandbox; do not access, change or delete other people's data; do not degrade the service (no load or denial-of-service tests); and do not move funds that are not yours.
- **Give us time to fix it** before you make it public. We confirm we received your report, keep you informed while we work on it, and tell you when it is fixed.
- If a credential of your tenant may have leaked, rotate it first ([Credentials & Rotation › If a Secret Leaks](https://docs.aureahub.com/docs/guide-credentials.md)), then tell us.

---

Web version: https://docs.aureahub.com/#guide-security