IT & Security Policy

1. Purpose and Objectives

DESTRAL is committed to protecting the confidentiality, integrity, and availability of its information systems, digital infrastructure, and data. This IT & Security Policy establishes the principles and controls designed to safeguard information assets, ensure operational resilience, and protect users against security threats.

2. Scope

This policy applies to all DESTRAL systems, platforms, applications, smart contracts, infrastructure, data, employees, contractors, service providers, and any third parties with access to DESTRAL information systems.

3. Information Security Principles

4. Access Control and Authentication

Access to DESTRAL systems and sensitive data is restricted to authorized personnel only, based on the principle of least privilege. Strong authentication mechanisms are enforced, including multi-factor authentication where appropriate. Access rights are reviewed regularly and promptly revoked when no longer required.

5. Data Protection and Encryption

DESTRAL implements industry-standard encryption protocols to protect data both in transit and at rest. Sensitive and personal data are handled in accordance with applicable data protection and privacy regulations. Secure key management practices are enforced.

6. Infrastructure and Network Security

Our infrastructure is monitored to detect, prevent, and respond to security threats. Security measures include firewalls, intrusion detection and prevention systems, segmentation of critical systems, and regular patching and updates.

7. Application and Platform Security

DESTRAL applies secure development and deployment practices, including code reviews, testing, and change management procedures. Security vulnerabilities are assessed and remediated in a timely manner.

8. Smart Account and Smart Contract Security

The smart accounts and the other smart contracts of the platform are designed so that DESTRAL cannot move the assets of a smart account without the signature of its owner. Withdrawals are restricted to addresses registered beforehand by the owner, and instructions are protected against replay. Smart contracts are tested before deployment and, where appropriate, reviewed by independent auditors. An audit reduces the risk of defects but does not eliminate it. Privileged roles over platform contracts, such as the administration of the coordinator contract, are protected by controls such as multi-signature authorization where technically feasible, and are limited to the persons who need them.

9. Relayer and Key Management

The relayer that submits the signed instructions of users to the blockchain networks, and the keys it uses to pay network fees, are operated with restricted access, secure storage of keys and monitoring. The relayer funds are limited to what is needed for the operation of the service. DESTRAL never holds the private keys, the passkeys or the recovery words of users, and never asks for them.

10. Monitoring, Logging, and Auditing

System activity is logged and monitored to identify suspicious behavior, unauthorized access, or anomalies. Logs are retained securely and reviewed as part of regular security assessments and audits. Penetration tests and security assessments of critical systems are carried out periodically.

11. Incident Response and Business Continuity

DESTRAL maintains incident response and business continuity procedures designed to respond effectively to security incidents, system failures, or cyberattacks. Incidents are investigated promptly, and corrective actions are implemented to prevent recurrence. Where an incident affects users, DESTRAL informs them as required by the applicable law.

12. Third-Party and Vendor Risk

Third-party service providers are subject to due diligence and security assessments to ensure they meet DESTRAL’s security standards. Access by third parties is limited, monitored, and governed by contractual safeguards.

13. User Responsibilities

Users are expected to follow good security practices, including protecting credentials, passkeys and recovery words, enabling available security features, never sharing their recovery words or signing a request they do not understand, and reporting any suspicious activity or potential vulnerabilities without delay. DESTRAL will never ask a user for a private key, a recovery phrase or a passkey.

14. Policy Review and Updates

This policy is reviewed regularly and updated as necessary to address evolving security threats, technological changes, and regulatory requirements.

15. Limitations

While DESTRAL implements security measures, no system can be guaranteed to be completely secure. Users acknowledge and accept the inherent risks associated with digital platforms and blockchain technologies.

16. Contact

To report a security issue or a vulnerability, please contact:

DESTRAL – Security

For other questions or concerns regarding this IT & Security Policy, please contact:

DESTRAL – Complaints Department