We are building financial infrastructure people will rely on to save, contribute, and access capital together. Protecting funds, data and trust is the work — at every level of the platform.
All value movement on the platform is tracked, recorded, and auditable. As we scale, funds will be held and processed through licensed financial partners and secure payment rails appropriate to each region.
We minimise the data we collect and secure what we store. Personal and financial information is protected with PBKDF2-SHA256 password hashing (260,000 iterations), industry-standard encryption in transit, and strict access controls.
Every transaction, contribution, and payout is logged and traceable. Our systems are designed to increase transparency while making misuse and manipulation structurally hard — not optional.
We are committed to aligning with global data protection standards as we expand. Privacy is not retrofitted — it is part of how the platform is engineered.
SOHANA enforces role-based access control across every administrative and operational function. Each role sees only what its responsibilities require — verified at every request.
Contributions, payouts, and balances are accurate because every operation leaves an audit trail. We are building safeguards that detect anomalies the moment they occur.
As we integrate real-money functionality, every market gets the rails that match its regulatory and infrastructure realities. We never run unlicensed value movement.
Security is an ongoing process, not a milestone. Here's what is in place today, what's shipping next, and what we are building toward as we scale toward real-money operation.
Specific timelines depend on regulatory approval cadence, partner availability, and capital deployment. Updates published quarterly.
The threat landscape changes monthly. Our infrastructure, monitoring, and review cadence must too. We commit to ongoing internal review, third-party audits as we scale, and adaptation as new risks and technologies emerge.
We treat incidents with the seriousness they deserve. We do not minimise, we do not delay, and we do not communicate by silence.
Contain the issue and protect affected users immediately, before public disclosure.
Notify affected users directly, with plain-language information about what happened and what to do.
Publish a post-incident report describing root cause and the changes made to prevent recurrence.
The strongest infrastructure can still be undermined by a weak password or a moment of phishing. Here's how to do your part.
Have a security concern, a vulnerability to report, or want to learn more about our practices?
Report a vulnerability: security@sohana.app