Security

20 layers of protection

Every deposit and payout passes through 20 independent layers of defense, from the API request down to the chain. If one layer is ever bypassed, the next one still stands.

Layers 01–04

API protection

01Signed requests
02Replay protection
03IP allowlisting
04Signed webhooks

Layers 05–08

Key protection

05Hardware-secured keys
06Isolated signing
07Transaction policy engine
08Encrypted credentials

Layers 09–12

Payout controls

09Transaction limits
10Large-payout approval
11Duplicate protection
12Automatic payout freeze

Layers 13–16

Fund integrity

13Vault-locked addresses
14Independent verification
15Finality checks
16Immutable ledger

Layers 17–20

Operations

17Continuous reconciliation
18Network isolation
19Audited access
2024/7 monitoring & alerts

We don't publish how each layer works. Keeping those details private is part of what keeps them strong.

A vault of coins inside a protective shield

Our guarantee

If our system fails, we carry the loss. Not you.

If funds are lost because of a fault in iCryptoNow's own platform, we cover it in full. Your players are credited and your balance is made whole, at our cost.

We cover

Faults in our address generation, signing, sweeping and payouts
Breaches or failures of our servers and infrastructure
Errors in our ledger or balances

Outside our scope

API calls made with your keys if they leak from your systems
Deposit addresses changed or replaced on your platform
Anything else that happens on your side of the integration

Your part of the setup

Our guarantee covers our systems. These steps keep your side just as safe.

Keep secrets server-side

Store your API and webhook secrets in a secrets manager. Never ship them to browsers or apps.

Register only your servers

Allowlist only the outgoing IPs of the servers that call our API.

Verify every webhook

Check the signature and timestamp before crediting a player, and deduplicate on event_id.

How request signing works