Security architecture

Design principles

Echlon's security architecture is built on three principles:

1. You own your keys. We never have access to your private keys. This eliminates the biggest single point of failure in traditional finance — the custodian.
2. Defense in depth. Multiple independent layers of security so that no single failure compromises the system.
3. Transparency. Costs, rates, and transaction details are disclosed before you confirm. If we have to update the price before sending, the amount taken from your balance can change.

Encryption

All data on the Echlon platform is encrypted using industry-standard protocols:

• At rest: All stored data — including personal information, transaction records, and any key-related material — is encrypted. Nothing is stored in plaintext.
• In transit: All communications between your device and our servers, and between our servers and partner systems, use TLS encryption.
• Key material: Private keys are encrypted in a way that even Echlon and our infrastructure partners cannot see or access — only your authenticated session can unlock them.

Key management

Your private key is the single most important piece of your wallet security. Here is how it is protected:

• Your key is generated during account creation and immediately encrypted
• The encrypted key is managed by Privy, our embedded wallet infrastructure partner built for non-custodial key security
• Echlon does not store, see, or have access to your private key at any point
• The wallet provider uses a zero-knowledge design — meaning the provider can facilitate key operations without ever being able to see or access the key itself
• Key decryption only happens within your authenticated session, for the purpose of signing transactions you have explicitly confirmed

This architecture means that even in a worst-case scenario — a full breach of Echlon's systems — an attacker would not be able to access your private keys or move your funds. For more details on wallets and key ownership, see Your wallet & keys.

Authentication & access control

• Multi-factor authentication (MFA) is required on all accounts
• Sessions are managed with automatic expiration and secure token handling
• Internal systems are access-controlled — only the services that genuinely need access to specific data have it
• Role-based access controls limit what each system component can do

Protecting your credentials

Echlon secures the platform, but two credentials are yours to protect — and they are exactly what attackers go after. Treat both as keys to your money.

• Your seed phrase (recovery phrase). It can restore your wallet — and the funds in it — in any compatible app, so anyone who sees it can take your money. Store it offline and private, never type it into a website, and never share it. Echlon cannot recover a lost seed phrase. See Your wallet & keys.
• Multi-factor authentication (MFA). MFA is required on every account and adds a second factor beyond your password. Use an authenticator app, keep your device's clock in sync so codes validate, and store any backup codes somewhere safe. Never read a code aloud or enter it on a site you reached from a message link. If you lose access to your authenticator, contact support from your registered email — we'll verify your identity and help you regain access.

Blockchain monitoring

Echlon integrates with Chainalysis, one of the leading blockchain analytics platforms, for real-time transaction monitoring and wallet screening. This includes:

• Screening wallet addresses against known sanctions lists
• Identifying exposure to high-risk on-chain activity (mixing services, darknet markets, sanctioned addresses)
• Continuous monitoring with daily data updates
• Risk scoring for incoming and outgoing blockchain transactions

This monitoring runs alongside our banking partners' own independent compliance and fraud monitoring systems, providing multiple layers of protection.

Wallet screening

All wallet addresses associated with the platform are screened for:

• Sanctions exposure (UN, OFAC, EU, HM Treasury lists)
• Terrorist financing links
• Criminal or illicit activity
• Interaction with services designed to obscure the origin of funds
• Interaction with known sanctioned addresses

If a wallet is flagged, the account may be immediately restricted and reported to relevant authorities.

Partner integration security

All integrations with banking and verification partners use:

• Signed webhook verification: Every instruction from a banking or verification partner is authenticated before the platform acts on it — preventing tampering or spoofed requests.
• Encrypted API communications: All partner integrations use secure, encrypted API connections
• Contractual security requirements: All third-party partners are held to security standards as part of their service agreements

Transaction monitoring

Every transaction on the platform is monitored in real time for:

• Unusually high amounts relative to account profile
• Unusual patterns such as rapid movements or transactions that appear designed to avoid detection
• Transactions with no apparent economic purpose
• Indicators of fraud or unauthorized access

Both Echlon and our banking partners independently monitor transactions. Your banking partner may hold, delay, or reject transactions that trigger compliance flags — this is an additional layer of protection beyond Echlon's own monitoring.

Data protection

• User data is segmented and access-controlled (data isolation)
• Personal data is processed in accordance with the BVI Data Protection Act and applicable privacy laws
• Data is retained for a minimum of 5 years after the business relationship ends (regulatory requirement)
• Secure and irreversible data disposal after retention periods expire
• You have the right to access, correct, and request erasure of your personal data (subject to legal retention requirements)

For more information, see Security & compliance.

Related articles

• FAQ — Quick answers to the most common questions
• Blockchain & Stablecoins — What stablecoins are, how they maintain their value, and why Echlon uses them behind the scenes
• Account Architecture — How your Checking, Cards, and Treasury accounts work under the hood, and how funds are kept separate and secure

Still need help?

Have a question that isn't answered here? See our support channels, message us on WhatsApp at +1 (787) 468-5842, or open a support ticket — we typically respond within 24 hours.