Best practices
Cybersecurity
Securing API keys, wallets, webhooks, and production infrastructure
High-value targets
Fintech platforms protect credentials that move money and data: tenant API keys, webhook endpoints, treasury wallets, and authentication secrets. Compromise at any layer can enable fund loss or data breach at scale—across every asset and corridor on the network.
Key practices
| Asset | Practice |
|---|---|
| Treasury wallets | Hardware-backed or multi-party controls; never expose signing material |
| API keys | Rotate regularly; separate sandbox and production |
| Webhooks | Verify signatures on Echo payloads before acting |
| Customer data | Keep PII off public ledgers; restrict access by role |
Treat secret comparison and storage as first-class engineering concerns—not afterthoughts.
Application security
- Validate all inputs on mutating endpoints
- Use idempotency so retries cannot double-spend
- Log structured events without PII or key material
- Apply standard HTTP hardening (headers, CORS allowlists)
Supply chain and ops
Pin dependencies, scan CI for leaked environment files, and restrict production access via SSO and break-glass procedures. Monitor platform Health signals and alert on abnormal payment volume.