Cryptographic Infrastructure

Security Architecture & Key Governance

2-of-3 Threshold MPC, Zero-Knowledge Non-Custodial Safeguards, and Enterprise Audits

2-of-3 MPC Split Keys

Cryptographic keys are never assembled in a single location. Mathematical threshold signing requires independent device authorization.

Field-Level Encryption

Bank routing transit numbers and account data are encrypted at rest using authenticated AES-256-GCM with hardware-backed key rotation.

Immutable Audit Trail

Every payout state change, risk calculation, and compliance screening event is cryptographically hashed with SHA-256 checksums.

1. The 2-of-3 MPC Split-Key Model

InstaPay IPX eliminates single points of cryptographic failure through a Threshold Signature Scheme (TSS). Private keys for worker smart wallets are generated directly as separate, non-reconstructable mathematical shares:

Key Share A: Client Hardware (User Device)Biometric Protected

Provisioned locally on the worker's iOS, Android, or desktop device via WebAuthn / FIDO2 Passkeys. This share never leaves the user's physical device and can only be unlocked via local biometrics (FaceID, TouchID) or device PIN.

Key Share B: Secure Cloud Enclave (InstaPay IPX Gateway)FIPS 140-2 Level 3 HSM

Isolated inside an AWS Nitro Enclave / confidential computing environment. This share acts as a co-signer only after multi-factor identity challenges and compliance screening filters pass in full.

Key Share C: Disaster Recovery Vault (Cold Storage)Offline Cold Split

Encrypted recovery share distributed across geographically redundant offline cold storage. Used exclusively for worker self-recovery if the user loses their primary device.

Non-Custodial Guarantee: Any transaction requires 2 of the 3 shares to compute a valid signature. Because InstaPay IPX only controls Share B, it is mathematically impossible for the gateway to initiate, redirect, or execute unauthorized transactions.

2. Infrastructure & Network Defense

  • Zero-Trust Architecture: Internal services communicate over mutual TLS (mTLS) with ephemeral authorization tokens and least-privilege role boundaries.
  • DDoS & Rate Limiting: Cloudflare edge protection, automated IP reputation filtering, and per-token rate limits (1,000 req/min production, 50 req/sec burst).
  • Secrets Isolation: No cryptographic private seeds or database credentials exist in source code or client builds. All runtime keys are provisioned through HashiCorp Vault / AWS KMS with automated 90-day rotation.

3. Compliance Framework & Audits

SOC 2 Type II Alignment

Our controls are continuously audited against the American Institute of CPAs (AICPA) Trust Services Criteria for Security, Availability, and Confidentiality.

Independent Penetration Tests

Third-party cybersecurity firms conduct semi-annual penetration tests and static application security testing (SAST) against all API routes and smart contract interfaces.

Responsible Vulnerability Disclosure

We welcome findings from independent security researchers. If you discover a potential vulnerability, please email our Security Operations Center directly at: security@instapayipx.com. We commit to acknowledging receipt within 24 hours and do not pursue legal action against researchers acting in good faith.