Security
Your money deserves serious protection.
Every control below is implemented and covered by the test suite. None of them are aspirations, and none of them remove market risk.
Append-only ledger
Every balance is the sum of ledger entries that are never updated or deleted. A correction is a new reversing entry, so the full history survives and any balance can be replayed from the first transaction.
Nightly reconciliation
A scheduled job proves that available plus locked equals the ledger sum for every wallet. Drift raises an alert the same night rather than surfacing in an audit months later.
Address cooling period
A newly added payout address cannot be used for 24 hours, and you are notified the moment one is added. A stolen session alone cannot add a destination and drain the balance in one sitting.
Withdrawal confirmation codes
Every payout request is confirmed with a six-digit code sent to your email, hashed at rest and locked after five failed attempts. Nobody at Invex will ever ask you for it.
Two-person approval
Withdrawals above a configured threshold require two different administrators to approve. One compromised staff account cannot move money on its own.
Encrypted identity documents
KYC uploads are stored on a private disk, served only through signed short-lived URLs, and validated by their actual byte content rather than their file extension.
Idempotent money movement
Every balance mutation carries a unique key enforced by a database constraint. A retried request credits a distribution once — never twice, never zero times — regardless of what the network did.
Full audit trail
Administrative actions are recorded with the actor, the before and after state, and a timestamp. Money-moving actions additionally re-authenticate the operator at the point of action.
What none of this protects you from
These controls reduce operational and custodial risk. They do not reduce market risk. No engineering removes the possibility of loss. before funding an account.