Security controls, not security claims.
Valescrow holds and releases institutional funds, so its integrity is not a marketing claim. The money core has been through repeated adversarial internal and AI-assisted code review with every Critical and High finding remediated; a third-party audit is scheduled before the first institutional mainnet funds. Here is how your money is protected.
Adversarially reviewed. Findings remediated before launch.
Valescrow's escrow, settlement, and distribution money core underwent an independent security audit — direct code review with adversarial verification of the highest-severity findings. Every Critical and High finding identified in the value-movement layer has been remediated and merged, and the fixes are covered by an automated test suite that runs on every change.
The auditor independently confirmed the strength of the security perimeter: webhook signature verification, row-level isolation, audit-log immutability, the N-of-M approval model, and server-side enforcement.
- Independent, code-level security audit
- Critical & High findings remediated
- Regression tests guard every fix
- Perimeter controls auditor-verified
Controls, not promises.
Signed webhooks, verified before any state change
Every money-path integration verifies its signature with a timing-safe comparison before a single record is written, and is idempotent on the provider reference so a replayed event can never credit twice.
Append-only audit trail
Every allocation event is written to a trigger-enforced, append-only log — no updates, no deletes. A complete, tamper-evident history of who did what, and when.
N-of-M approvals
Releases can require multiple independent signatures. On multi-party escrows the creator cannot unilaterally satisfy an approval — the threshold is enforced server-side.
Row-level isolation
Postgres row-level security scopes every read and write to its owner (and their linked accounts). One organization can never see or touch another's escrows.
Least-privilege API keys
Keys are bcrypt-hashed at rest, shown once, scoped to only the capabilities they need, and rate-limited per key and per IP. Live and test environments are fully separated.
Secrets never exposed
Wallet addresses never appear in a URL, page source, or API response. Milestone secrets are scrubbed from every response. Sensitive identifiers stay server-side.
Rules that hold on every transaction.
- All value moves as integer BigInt wei — never floating-point.
- Fees are loaded from configuration at runtime and always disclosed before an action — never silently absorbed.
- Transaction limits, merchant gating, and release conditions are enforced in server-side functions, not the client.
- Webhook signatures are verified with timing-safe comparison prior to processing.
- Funding proofs are bound to the sender and consumed once, globally.
- Refunds return to the original funder's address.
Responsible disclosure
If you believe you have found a security issue, please report it privately to security@valescrow.com before any public disclosure. We investigate every report and will keep you updated on remediation.