Security
Built to be correct before it is fast
Nowgate is in development and doesn't hold real funds yet. This page describes what is built today and what custody will look like at launch. We make no claims of audits or certifications we don't have.
Built today
A ledger the database enforces
Ledger entries are append-only. Each transaction must sum to zero per asset, balances can't go negative, and the application's database role can't edit or delete history. An hourly job re-checks that every balance equals the sum of its entries.
Credits only at finality
Deposits are credited after the network's confirmation rules are met. Chain reorganizations are detected; a credit whose deposit disappears is reversed, and a watcher halts rather than guess when a network breaks its own finality.
Verified by a second operator
Before a deposit is credited, a node run by a different operator must report the same transfer and agree that its block is final. If they disagree, the deposit is held, never credited.
Checked against the chains
Every ten minutes, each wallet's balance on its chain is read through two independent operators and compared with the ledger, per network and asset. A confirmed shortfall raises a critical alert at once, and no note can silence it.
Keys in a separate signer
Seeds and private keys live only in the signer, a separate process with no network, which the rest of the engine reaches through a socket. It builds every transaction itself, checks it against its own policy (limits, and payout addresses it has known for a day), keeps a hash-chained log of every signature, and never logs a secret.
A signer that starts sealed
In production, the key that opens the signer's keystore is never stored on disk. Each time the signer starts, two of three key holders type in their shares to rebuild it in memory, so a copy of the signer's files reveals nothing.
Backups to the minute
The database is archived continuously, at most a minute behind, with a full backup each week and a differential one each day, encrypted and kept off-site. A drill restores the backups every week and checks the restored ledger.
Monitored, with alerts
Every process, network, database and backup reports to monitoring Nowgate runs itself. Alerts reach the operators by email, each with the steps to take, and a daily heartbeat proves the alerting itself works.
API keys stored as hashes, and limited
Keys are shown once and stored only as hashes. Each carries scopes, keys that can move money require an IP allowlist, and the engine limits the requests of every key and every client address itself.
Webhooks you can trust, sent safely
Events are signed with HMAC-SHA256 and a timestamp. Endpoint secrets are sealed so only the delivery process can read them, and deliveries refuse private and internal network addresses.
Before real funds
A careful start
Mainnet opens as a canary: a few merchants at first, small limits per payout and per day, enforced by the engine and again by the signer, and the networks opened one phase at a time.
Most funds offline
Until cold storage is in place, each hot wallet's balance is capped and watched. Before the limits rise, the excess moves to cold storage, kept offline.
Reviewed before launch
A threat model covers every trust boundary, and an internal review with open-source scanners has fixed or recorded every finding. An external review comes before any real funds are processed.
Service status
The status page shows each part of Nowgate as its own probes see it, with 90 days of uptime, incidents and their updates, and planned maintenance. It is static files, so it stays up when the rest doesn't, and its feed lets you follow it.
Reporting a vulnerability
A security contact and disclosure policy will be published here before launch. To verify the webhooks you receive, follow the webhook guide.