Everything a due-diligence review asks for
Security posture per product, the providers we rely on, live availability and how to reach us about vulnerabilities — collected on one page instead of scattered across a questionnaire.
How each product handles trust
The three products share one security foundation, but each carries its own controls where its risks live.
Monbits Exchange
- KYC and AML tooling built into the operator admin panel
- Two-factor authentication and role-based access for staff accounts
- Immutable audit logs on admin actions and balance movements
- Each white-label deployment runs under the operator's own brand and legal setup
Monbits Pay
- Every incoming payment is AML-screened before it settles
- Wallet keys live in an isolated key-management service — AES-256-GCM, internal network only
- Merchant webhooks signed with HMAC-SHA512, with stable delivery IDs for safe retries
- Immutable audit logs on every balance movement
Monbits Card
- PCI DSS-compliant issuing infrastructure
- KYC before a card is issued, with AML checks running alongside
- 3-D Secure on online payments
- Sensitive cardholder data encrypted at rest with role-based access control
Built to stay up — and measured in public
Redundancy is designed in where it matters: swap orders can route across multiple liquidity providers, card top-ups run through interchangeable payment providers, and DDoS protection with rate limiting keeps services reachable under attack. The status page checks the platform's public endpoints continuously.
The providers we rely on
Kept deliberately short. Each entry says what the provider does and which part of the platform touches it.
| Provider | Purpose | Scope |
|---|---|---|
| Cloudflare | Site and API hosting, CDN and DDoS protection | Website & platform edge |
| Resend | Transactional email delivery for contact and demo form submissions | Website forms |
| Telegram | Operational alerts to the team for new leads and incidents | Internal operations |
| Liquidity providers (ChangeNow, ChangeHero) | Order routing for swaps when an operator enables external liquidity | Exchange — operator-enabled |
This list covers the Monbits platform and website. A white-label deployment may add providers its operator chooses — those are documented per deployment, not here.
What we collect, and what we deliberately don't
Self-hosted analytics
This site runs self-hosted analytics (OpenPanel). No third-party ad trackers, no data resold, nothing shipped to an ad network.
Data minimization
Forms collect only what a reply needs. KYC data is collected inside the products only where regulation requires it — never for the website.
Encryption
Sensitive data is encrypted at rest, and wallet keys live in an isolated service that never faces the public internet.
GDPR-aligned
Data practices follow GDPR principles — lawful basis, retention limits and subject rights. The privacy policy has the specifics.
Found a vulnerability?
We welcome responsible disclosure. Report security issues straight to the team — machine-readable contact details live in our security.txt.
Running a vendor review?
Send over your security questionnaire — our team answers due-diligence requests directly, without a sales detour.
Contact the team