Key sovereignty
PrimaOrdia should never receive or store private keys. Signing occurs through the bank’s wallet, HSM, MPC service or offline approval flow.
Security architecture
No PrimaOrdia keys.
No PrimaOrdia custody.
The intended security model keeps private keys, asset custody and final deployment authority with the issuing institution or its chosen regulated custodian. PrimaOrdia prepares and governs the workflow; the bank authorizes the consequential action.
Security principles
Control the people, code, keys and change.
These are design requirements for production—not claims that certifications or controls have already been completed. Independent assurance and institution-specific review are launch gates.
Strong identity
Enterprise SSO, phishing-resistant MFA, role-based access, tenant isolation and time-bounded privileged access.
Segregated duties
Four-eyes approval for contract changes, deployment and lifecycle actions, with no single user able to complete a critical workflow.
Policy enforcement
Allowlisted destinations, transaction simulation, limits and contract-function policies before the institution is asked to sign.
Auditable change
Immutable event records, versioned configurations, signed build artefacts and clear evidence of who approved what and when.
Defence in depth
Encryption, network segmentation, secure secrets handling, dependency controls, monitoring, incident response and tested recovery.
Smart contract safeguards
Make authority explicit before deployment.
A contract can automate rules, but it can also automate mistakes. Every permission, dependency and recovery path should be visible to legal, risk, security and operations before a bank signs.
- 01
Reviewed templates
Version-pinned source, reproducible builds, independent audit and published scope for every supported template.
- 02
Minimal privilege
Separate issuer, compliance, transfer, pause, mint, burn and upgrade roles; grant only what each role needs.
- 03
Safe upgrades
Prefer immutable contracts where practical. Where upgrades are required, use transparent governance, timelocks and bank-controlled multisignature approval.
- 04
Pre-deployment simulation
Verify network, bytecode, constructor parameters, administrator addresses, permissions and expected fees before signing.
- 05
Controlled recovery
Define pause, freeze, recovery and redemption processes in the legal terms and operating procedures—not only in code.
- 06
Continuous monitoring
Monitor privileged calls, role changes, anomalous transfers, oracle health and divergence from the offchain legal register.
Production launch gates
Evidence before assurance language.
PrimaOrdia should not present itself as bank-grade until the controls are independently tested and the evidence is available to institutional diligence teams.
Required before live issuance.
- Independent smart contract audit and remediation closure
- External penetration test and secure SDLC review
- Documented threat model, data flows and shared-responsibility matrix
- SSO, MFA, RBAC, segregation of duties and privileged-access review
- Incident response, business continuity and disaster recovery tests
- Vendor, dependency, chain and oracle risk assessments
- SOC 2 Type II and ISO 27001 readiness programme with truthful status
- Legal and regulatory approval for each issuance operating model
Shared responsibility
Security starts with clear ownership.
PrimaOrdia secures the platform workflow. The institution secures identity decisions, wallet policy, keys and approvals. Licensed providers remain responsible for their regulated services.
Request the architecture brief