Trust is replaced by verification
Every design decision in LedgerBridge starts from one question: can the bank verify this, or is it being asked to trust it? This page is written for your CISO, your compliance officer and your examiner.
Keys that are born in hardware and never leave it
FIPS 140-3 Level 3 hardware
Signing and encryption keys are generated inside validated cloud HSMs and are non-exportable by design.
No software fallback
If the HSM is unavailable the platform refuses to sign. There is no degraded mode.
Per-client keys
Each customer wallet has its own keys. No master key, no omnibus exposure.
Documented ceremonies
Key creation and rotation follow written, witnessed procedures under dual control.
The bank is a signer, not a spectator
Withdrawals require two of three signatures. The bank's key lives in the bank's own HSM, connected over mutually authenticated TLS. Before signing, the bank-side component re-checks the transaction byte for byte against what it approved, so the platform cannot substitute a different destination.
- Role-gated emergency stop at five points of the flow
- Wallet freeze that blocks withdrawal and signing
- Compliance holds with operator approve/reject, attributed and logged
- Key rotation for both platform and bank keys without downtime
- Compliance bypass flags are hard-blocked in production, checked at startup and in CI
- Personal data encrypted at rest with AES-256-GCM
- Session tokens kept out of browser storage; httpOnly cookies only
- Constant-time comparison for API credentials
- Outbound requests to bank identity providers restricted to HTTPS with private-network and DNS-rebinding protection
- Dependency and vulnerability audit gate in every release pipeline
Sequenced inside the transaction
Compliance is not a report run after the fact. It is a state machine every deposit and withdrawal must pass through.
Identity
CIP/KYC via the platform provider or reliance on the bank's onboarding; MFA through your identity provider.
Screening
OFAC/SDN synchronized continuously; address risk scoring from blockchain analytics providers.
Monitoring
Configurable AML rules raise alerts; officers review, approve or reject in the Compliance Portal.
Reporting
FinCEN-format SAR composition, per-bank storage, filing by the regulated entity; append-only audit log.
Built to be examined
- Tenant isolation: separate data, signing secrets and reporting replicas per bank
- System health endpoint covering database, HSM, blockchain node and messaging
- Maintenance mode, dead-letter replay and lag monitoring on all queues
- Self-service, permissioned analytics for internal audit
- Independent security review of the full codebase, with findings tracked to closure
| OCC IL 1170 / 1174 / 1183 | Custody, stablecoin reserves and ledger-based payment activities |
| GENIUS Act (PL 119-27) | Payment stablecoin framework; effective by January 2027 |
| BSA / AML | CIP/KYC, OFAC, transaction monitoring, SAR |
| FDIC | Tokenized deposits remain insured deposits, subject to ownership category and limits |
Certifications, insurance and licenses are stated on this site only once obtained. Ask us for the current attestation package.
Questions from vendor due diligence
Can LedgerBridge move customer assets without the bank?
No. Every withdrawal needs two of three signatures, and one of those keys lives in the bank's own hardware security module. The bank-side component checks the exact transaction before it signs. Neither LedgerBridge nor the bank can move funds alone.
Where are keys generated and stored?
Keys are generated inside FIPS 140-3 Level 3 validated hardware security modules and are non-exportable by design. Each customer wallet has its own keys, with no master key. If the hardware is unavailable the platform refuses to sign. There is no software fallback.
What happens if LedgerBridge is unavailable?
Customer assets are never held on LedgerBridge's balance sheet and never under LedgerBridge's sole control. The bank's key together with the recovery key, held under dual control and a documented ceremony, is sufficient to recover customer assets without us.
Do you answer vendor due diligence questionnaires?
Yes, in full, and we walk the bank's risk, compliance and security teams through the architecture. We state certifications, insurance and licenses only once they are obtained, and we provide the current attestation package on request.
Preparing a review? Start from our 25 vendor due diligence questions and the board guide to bank-controlled custody.
Send us your security questionnaire.
We answer vendor due-diligence questionnaires in full and walk your team through the architecture.