Security at SUPERBLOCK
Security and compliance are foundational, not features. Every layer is designed to institutional standard, from the token contract to key management.
- ISO 27001 compatible
- Independent audits
- MPC custody
- Proof of Reserve
Standards and Certification
Institutions cannot adopt infrastructure they cannot trust, so security is built into every layer rather than reviewed at the end.
ISO 27001 compatible
Our information security management system is aligned to ISO 27001, the international benchmark for managing information security.
Controls in the contracts
Each product uses the standard built for its job: security tokens under ERC-3643 check eligibility on every transfer, and ERC-4337 smart accounts enforce security policy in the account itself, so controls cannot be bypassed in an app or at a venue.
Independent audits
Smart contracts are independently audited before deployment, and the AI layer continuously stress-tests and hardens platform components.
How We Protect Assets and Data
- 01Institutional custodyKey management uses multi-party computation, so no single party ever holds a complete signing key. Qualified custodians are integrated where a regulatory regime requires it.
- 02Proof of ReserveOn-chain verification that tokenised and wrapped assets are backed, with minting gated on sufficient verified reserves.
- 03Privacy-preserving compliancePersonal data stays encrypted off-chain and is shared only with consent; zero-knowledge proofs confirm eligibility without disclosure and let institutions settle without revealing holdings.
- 04Checked before settlementEligibility, sanctions and recipient checks run before value moves, not reconciled afterwards. If a check cannot run, the transaction does not proceed.
1/3 · Key shares. A signing key is generated as separate shares held by independent parties. The whole key never exists anywhere.
Security as Architecture
Because every product is composed from the same shared module library, security controls are uniform across the ecosystem rather than rebuilt for each product. The AI layer verifies that a combination of modules is compatible before it deploys, manages upgrades so the correct versions are used, stress-tests components, and works to keep the platform free of vulnerabilities. It is designed never to hold a key or sign a transaction.
1/5 · Compose. Before a platform deploys, the AI checks that the selected modules are compatible and connect correctly.
Responsible Disclosure
If you believe you have found a security vulnerability in superblock.ai or a SUPERBLOCK product, please tell us using this form. We welcome reports from researchers acting in good faith.
What to include
- A description of the issue and its potential impact
- Steps to reproduce it, including affected URLs, contracts or components
- Any proof-of-concept code or screenshots
- How we can reach you for follow-up
Please
- Give us reasonable time to investigate and fix the issue before disclosing it publicly.
- Only access the data you need to demonstrate the issue, and do not keep, share or modify it.
- Do not run denial-of-service tests, social engineering, spam or physical attacks.
- Do not test against other people’s accounts or funds.
What we will do
Acknowledge your report, keep you informed while we investigate, and credit you when the issue is fixed if you would like. We will not pursue legal action against research carried out in good faith and in line with these guidelines.
Report a vulnerability
Reports go straight to the security team. Please do not include personal data you do not need to share.