How Your Funds Are Secured
Audited
By Cantina, our security partner since December 2024.
Smart-Contract Vault
Funds sit in a smart contract (EVM) or program (Solana), not in a wallet someone holds. Strategies execute inside it.
Isolated Signing
Signing keys live in a separate, isolated signing service. Apps and databases never hold raw keys.
Separate Services
Funding, execution, sending and the API each have scoped permissions, over encrypted connections off the public internet.
Multisig
Contract ownership and admin roles need multisig approval.
Sign-in
Handled by a separate login service (email code, wallet, optional 2FA), apart from custody.
Two-Factor Authentication
Add a second step with an authenticator app: a code when you log in, and optionally every time you send.1
Open Settings
Then the Security tab.
2
Enable 2FA
Switch it on and connect your authenticator app. Sonar then asks for a code when you log in.
3
Use 2FA On Withdraw
Switch this on too, and every send asks for a 2FA code. It only works once 2FA is on.
Related
Privacy
What stays private in the Vault, and what is public in a wallet.
Send
Ask for a 2FA code on every send.