SECURITY001 - Security overview

Last updated: August 18, 2026

Security overview

Security is paramount when dealing with financial transactions and payments. For over 10 years, Xtrm has developed and implemented a range of advanced, integrated security measures to ensure system integrity and data protection.

 

Password Protection

  • Complex Password Access: All user access requires complex passwords with a minimum of 8 characters, including numbers and special characters.

  • SHA Encryption with Salt: All passwords are securely stored using SHA encryption with salting, making them unencryptable.


Access Controls

  • Access Lockout: Multiple failed login attempts result in account lockout and are logged for security monitoring.
  • IP-Based Access: IP-specific restrictions can be implemented for controlled and secure access.
  • Location-Based Access:  Geographic restrictions can be applied for an additional layer of protection.
  • One Time Passwords (2 step authentication): OTPs are used for added security, with validation based on both device and IP.
  • CAPTCHA Protection: CAPTCHA technology is in place to prevent automated attacks and ensure that only legitimate users gain access.


Role & Activity Monitoring

  • Advanced Role-Based Access: Multi-tiered, role-specific access allows for granular user permission control across teams and departments.

  • Real-Time KYC Validation  (Know your customer): Immediate verification of individuals and companies during onboarding and payment transactions.

  • Real-Time AML validation  (Anti-Money Laundering): Instant checks on all payment activity to detect and prevent suspicious transactions.


Data & Network Security

  • Secure Encrypted Data: All data is encrypted both at rest and in transit using state-of-the-art methods. Detailed specifications are available upon request.

  • Regular Independent Site Scans: Third-party vulnerability scans (static and dynamic) are conducted regularly using providers such as Veracode and Trustwave.

  • Firewall Protection: Enterprise-grade firewall systems guard against unauthorized access.

  • Web Application Firewall (WAF): Protection against DoS/DDoS attacks, spam bots, and SQL injection threats.

  • Physically Secure Servers: All servers are housed in highly restricted facilities with secure passkey access and monitoring.

Compliance & Policies

  • SOC1 and SOC2 Compliant: Certification documentation available upon request.
  • PCI Compliant: Subject to regular external vulnerability assessments.

  • Security Policies: Formal, documented security policies are in place and regularly reviewed.