Security Built on Industry Standards
ChainSentrix is built from the ground up with security as the foundation. We implement multiple international security standards to protect your data.
Zero Wallet Access Architecture
ChainSentrix is architecturally designed to never access your cryptocurrency assets. We only monitor publicly available policy pages - the same pages you could read yourself in a browser.
Security Standards We Follow
OWASP Top 10 2021
Full protection against the most critical web application security risks including injection, broken access control, cryptographic failures, and SSRF.
- Input validation & sanitization
- Parameterized database queries
- Content Security Policy (CSP)
- URL allowlisting for SSRF prevention
ISO 27001:2022
Information security management following international standards for confidentiality, integrity, and availability.
- Access control policies
- Cryptographic controls
- Operations security
- Incident management
SOC 2 Type II
Service organization control principles for security, availability, processing integrity, confidentiality, and privacy.
- Security monitoring
- Change management
- Risk assessment
- Vendor management
NIST Cybersecurity
Framework for improving critical infrastructure cybersecurity with identify, protect, detect, respond, and recover functions.
- Asset management
- Protective technology
- Anomaly detection
- Recovery planning
GDPR Compliance
EU General Data Protection Regulation compliance for data protection and privacy.
- Data minimization
- Right to erasure
- Data portability
- Privacy by design
PCI DSS
Payment Card Industry Data Security Standard compliance through Stripe - we never store payment data.
- Stripe handles all payments
- No card data stored
- Secure transmission
- Access restrictions
Technical Security Measures
Encryption
- AES-256-GCM encryption at rest
- TLS 1.3 encryption in transit
- PBKDF2 key derivation (100,000 iterations)
- Secure random number generation
Authentication
- Secure session management
- Rate-limited login attempts (5/15min)
- Magic link authentication
- Automatic session expiration
API Security
- Rate limiting (60-120 req/min)
- CORS protection
- CSRF token validation
- Input validation on all endpoints
Infrastructure
- Supabase (SOC 2 compliant hosting)
- Vercel Edge Network
- DDoS protection
- Automatic failover
HTTP Security Headers
| Header | Purpose | Status |
|---|---|---|
Strict-Transport-Security | Forces HTTPS connections (HSTS) | Enabled |
Content-Security-Policy | Prevents XSS and code injection | Enabled |
X-Content-Type-Options | Prevents MIME type sniffing | Enabled |
X-Frame-Options | Prevents clickjacking attacks | Enabled |
Referrer-Policy | Controls referrer information | Enabled |
Permissions-Policy | Restricts browser features | Enabled |
Data Protection
- Encrypted at RestAll data encrypted with AES-256-GCM
- Encrypted in TransitTLS 1.3 for all connections
- Audit LoggingAll security events logged and monitored
Your Rights
- Data AccessRequest a copy of all your data anytime
- Data DeletionFull deletion within 30 days of request
- Data PortabilityExport your data in standard formats
Found a Security Issue?
We take security seriously. If you've discovered a vulnerability, please report it responsibly to our security team.
Report to chainsentrix@yahtai.comWe aim to respond within 24 hours