Our Commitment to Security

iMoose's security philosophy follows from three principles:

Building defense-in-depth against external threats

protecting against human error

Guarding against misuse of insider access

digital asset security

The majority of customer digital assets (e.g., bitcoin) are held in our offline (i.e., air-gapped) vaulted storage system ("Cold Storage"). Only a small portion of digital assets are held in our online wallet ("Hot Wallet").

hot wallet

  • Our Hot Wallet environment is hosted on Google Cloud Platform ("GCP"). GCP has a proven track record for physical security model and internal controls. More information can be found here.
  • Tiered access-controls are applied to our production environment to restrict access to employees based on role, following the principle of least-privilege.
  • Administrative access to our production environment requires multi-factor authentication.
  • Hot Wallet key management is rooted in hardware security modules ("HSMs"). We use the hosted CloudHSM service provided by GCP, which offers dedicated HSMs within the GCP network.
  • The specific hardware used by CloudHSM has been evaluated and achived the rating of Level 3 according to federal information processing standard publication 140-2 ("FIPS PUB 140-2").

COLD STORAGE

Our Cold Storage system provides two tiers of offline storage dubbed "cold" and "cryo" (short for "cryogenic") for improved security and redundancy.

  • We use HSMs that have achieved a rating of FIPS PUB 140-2 Level 3 (or higher).
  • All cold and cryo private keys are generated, stored and managed onboard our HSMs for the lifetime of the key.
  • We use Multisignature technology ("Multisig") to provide both security against attacks and tolerance for losing access to a key or facility, eliminating single points of failure.
  • All HSMs are stored in guarded, monitored and access-controlled facilities that are geographically distributed.
  • Hardware is sourced from diverse manufacturers to guard against supply-chain risks.
  • All fund transfers require the coordinated actions of multiple employees (i.e., all facilities are "no-lone zones").

financial security

  • We are a full reserve digital asset exchange. Customers may only trade from pre-funded accounts.
  • All customer USD fiat funds are held in an omnibus account at an FDIC-insured bank located in the US.
  • All customer fiat funds are segregated and legally distinct from our business and operating accounts.
  • All customer USD fiat funds are eligible for FDIC insurance, subject to applicable limitations.

iMoose Website

  • We are a full reserve digital asset exchange. Customers may only trade from pre-funded accounts.
  • All customer USD fiat funds are held in an omnibus account at an FDIC-insured bank located in the US.
  • All customer fiat funds are segregated and legally distinct from our business and operating accounts.
  • All customer USD fiat funds are eligible for FDIC insurance, subject to applicable limitations.

INTERNAL CONTROLS

  • Multiple signatories are required to transfer funds out of Cold Storage.
  • Our CEO,CTO,CFO are unable to individually or jointly transfer funds out of Cold Storage.
  • Our offices do not store or contain anything of value. All private keys are stored offsite in secure facilities (see Digital Asset Security above).
  • All employees undergo criminal and credit background checks, and are subject to ongoing background checks throughout their employment.
  • All remote-access by employees uses public-key authentication – no passwords, one-time passwords ("OTPs") or other phishable credentials are allowed.

Questions?

If you have any questions or concerns about your iMoose account – or believe there has been an unauthorized login attempt and/or transaction that you do not recognize – please email our customer support team at support@imoose.com.