Sardis

Trust Center

How Sardis protects your agents, your money, and your data. Security architecture, compliance status, subprocessors, SLA, and data processing.

Security Architecture

Non-Custodial by Design

Sardis never holds your private keys. All wallet operations use MPC (Multi-Party Computation) via Turnkey, where key shares are distributed across multiple parties. No single entity -- including Sardis -- can unilaterally sign a transaction.

Policy-First Execution

Every payment passes through a 12-check policy pipeline before any funds move. The pipeline is fail-closed: if any check fails or the policy engine is unreachable, the payment is rejected. This includes:

  • Per-transaction amount limits
  • Daily, weekly, and monthly spending caps
  • Merchant allowlist/blocklist with MCC code filtering
  • Token type restrictions
  • Purpose requirement enforcement
  • Human approval threshold routing
  • Cross-rail deduplication
  • Sanctions screening (OFAC/FATF)

Authentication and Access Control

  • Passwords: Argon2id hashing (PBKDF2 fallback with 100K iterations)
  • JWT tokens: HS256 with JTI-based revocation via Redis blacklist
  • API keys: SHA-256 hashed before storage, constant-time validation
  • MFA: TOTP-based (compatible with Google Authenticator, Authy, 1Password)
  • Rate limiting: Per-IP and per-org, Redis-backed with in-memory fallback
  • CORS: Explicit origin allowlist (no wildcards with credentials)

Data Protection

  • In transit: TLS 1.3 with HSTS (1 year, includeSubDomains, preload)
  • At rest: AES-256 encryption via cloud provider (Neon PostgreSQL, GCP)
  • Credentials: Fernet symmetric encryption for delegated tokens
  • Logs: Sensitive data masked (auth headers, API keys, passwords)
  • Headers: CSP, X-Frame-Options DENY, X-Content-Type-Options nosniff

Infrastructure Security

  • Deployment: Cloud Run (GCP) with non-root containers, multi-stage Docker builds
  • CI/CD: Gitleaks secret scanning, Trivy container scanning, Bandit SAST, pip-audit dependency scanning
  • Webhooks: HMAC-SHA256 signatures with 5-minute replay window, SSRF prevention on URLs
  • Kill switch: Multi-scope emergency stop (global, org, agent, rail, chain)

Compliance Status

FrameworkStatusDetails
SOC 2 Type IIIn ProgressPreparing with DSALTA. Target: Q3 2026.
GDPRCompliantData export, deletion, consent management, DPA available.
CCPACompliantData access, deletion, opt-out rights supported.
PCI DSSVia PartnerCard processing handled by Stripe (PCI Level 1 certified).
KYC/AMLIntegratedDidit for identity verification, Elliptic for sanctions screening.
Travel RuleEnforcedFATF R.16 compliance above $3,000 threshold (IVMS101 format).

Subprocessors

ProviderPurposeData ProcessedLocation
TurnkeyMPC wallet custody and signingPublic keys, transaction dataUSA
DiditKYC identity verificationGovernment ID, selfie, name, DOBEU
EllipticAML/sanctions screeningWallet addresses, transaction hashesUK
StripeBilling, virtual card issuancePayment method, email, planUSA
NeonPostgreSQL database hostingAll application dataUSA (AWS us-east-1)
AlchemyBlockchain RPC accessTransaction data, wallet addressesUSA
Google CloudAPI hosting (Cloud Run)API requests, logsUSA (us-east1)
UpstashRedis cachingSession data, rate limitsUSA
PostHogProduct analyticsUsage events, anonymized behaviorEU

Service Level Agreement

Uptime Target: 99.9% monthly uptime for api.sardis.sh and dashboard.sardis.sh, excluding scheduled maintenance.

Maintenance Windows: Sundays 02:00-06:00 UTC with at least 48 hours advance notice.

Incident Response

SeverityDescriptionResponse TimeUpdate Cadence
P0 -- CriticalComplete service outage or data breach< 30 minutesEvery 30 minutes
P1 -- HighMajor feature unavailable, payments blocked< 2 hoursEvery 2 hours
P2 -- MediumDegraded performance, non-critical feature down< 8 hoursDaily
P3 -- LowMinor issue, workaround available< 24 hoursAs resolved

Data Retention

Data TypeRetentionBasis
Account data3 years after deletionContractual
Transaction records7 yearsRegulatory (financial records)
KYC documents5-7 yearsAML/CFT regulations
API logs90 daysOperational
Analytics events12 monthsLegitimate interest

Security Contact

We commit to acknowledging security reports within 24 hours and providing an initial assessment within 72 hours.