Bithaven is a custodial finance platform. Security is not a feature — it is the product. Every layer of our architecture is designed to keep your funds safe while giving your AI agents the autonomy to transact.
Defense in depth — no single control failure can lead to fund loss or data breach.
All funds remain under your custody at all times. AI agents receive scoped access to sub-wallets — they can spend within your policies but can never withdraw funds from the platform. Only you can move money out.
Every agent transaction is evaluated against your configured policies before execution. Daily spending caps, lifetime limits, and address whitelists are enforced server-side. No transaction bypasses the policy engine.
Agent API keys are SHA-256 hashed at rest and never stored in plaintext. Keys are scoped to individual wallets, expire automatically (default 90 days), and can be revoked or rotated instantly.
Every transaction, policy change, approval decision, and administrative action produces an immutable log entry with timestamp, actor, and outcome. Full visibility into everything on your account.
All data is encrypted in transit via TLS and at rest. Secrets are stored in encrypted environment variables and never appear in logs, error messages, or API responses.
Multi-layered rate limiting protects against brute-force attacks, credential stuffing, and API abuse. Account lockout activates after repeated failed attempts, with automatic security alerts.
Industry-standard password hashing, JWT-based sessions with device fingerprinting, optional multi-factor authentication (TOTP), and automatic session invalidation on suspicious activity.
Hierarchical deterministic (HD) wallet architecture using the BIP-44 standard. Private keys never exist at rest — they are reconstructed on-demand for transaction signing and immediately discarded from memory.
On-chain deposits require multiple block confirmations before crediting. Idempotent processing prevents double-counting. Blockchain reorganization detection automatically flags and reverses affected transactions.
All API inputs are validated against strict schemas before processing. Parameterized queries prevent SQL injection. Content Security Policy headers and XSS protections are enforced on all responses.
Documented incident response procedures with severity-based escalation and containment playbooks. Business continuity and disaster recovery plans with tested backup restoration procedures.
User Layer
Control Plane
Agent Layer
Financial Core
Blockchain
Each layer communicates via authenticated APIs with full audit logging
Security controls are documented, reviewed quarterly, and continuously improved.
Security Standards
Controls designed following ISO 27001 and OWASP Top 10 best practices
Dependency Scanning
Automated daily scanning for known vulnerabilities across all dependencies
Access Control
Documented least-privilege access model with mandatory two-factor authentication on all infrastructure
Data Classification
Four-tier data classification policy governing handling, storage, and access for all asset types
Risk Management
Formal risk register with quarterly review, scored against a likelihood × impact matrix
Quarterly Reviews
All security policies, risk assessments, and access controls are reviewed and updated every quarter
We welcome security researchers who help us keep Bithaven and our users safe.
We will not pursue legal action against researchers who act in good faith, only interact with accounts they own, do not exploit vulnerabilities beyond what is necessary to demonstrate them, and report findings promptly without public disclosure before we have had reasonable time to respond.
In Scope
Out of Scope
Send your findings to [email protected]. Include a clear description, steps to reproduce, and any proof-of-concept code. We acknowledge reports within 48 hours, provide an initial assessment within 5 business days, and aim to resolve critical issues within 30 days.
We offer public acknowledgment (with your permission) for valid vulnerability reports. As Bithaven grows, we plan to establish a formal bug bounty program with financial rewards.
We are happy to discuss our security practices in detail with prospective and current users.
See also: Terms of Use · Privacy Policy
Last updated: February 2026