Security is built into the rails.
RailOS moves real money over card and stablecoin rails, so custody, access control, and payment verification are enforced at the code level. The practices below describe controls that are implemented in the platform today.
AES-256-GCM key custody
Embedded-wallet private keys and the platform settlement hot-wallet key are encrypted at rest with AES-256-GCM authenticated encryption. A fresh random IV is used per encryption and the GCM auth tag is verified on every decrypt — a tampered ciphertext fails instead of returning garbage. Keys are never logged, returned in errors, or serialized.
Fail-closed key handling
Master keys and settlement passphrases are loaded strictly from environment variables. If a key is absent or malformed, encryption and signing fail closed — no wallet is created and no value moves — rather than falling back to a weak or default key.
Short-lived JWTs + refresh tokens
Access tokens are short-lived (15-minute expiry) and paired with longer-lived refresh tokens, so a leaked access token has a narrow window of use. Sessions can be listed and revoked individually or all at once.
Scoped API keys
Programmatic access uses API keys with explicit scopes, verified by a dedicated guard on every request. Keys carry only the permissions they are granted and can be listed and rotated.
Role-based access control
Privileged routes are gated by role-based access control. The roles guard runs after authentication and is fail-closed: a protected route with no authenticated user in the required role is rejected.
On-chain settlement verification
Stablecoin and x402 payments are verified on-chain before any receipt is issued. If a transaction cannot be verified for the expected amount and recipient, the attempt is recorded for auditing and rejected — there is no receipt without a confirmed payment.
Audit logging
Sensitive actions across authentication, administration, and integrations are written to an audit log, creating a durable record of security-relevant events.
Additional controls
Multi-factor authentication (TOTP) and passkeys are supported for account access, and payment webhooks are processed with signature handling and delivery monitoring.
Compliance posture
PCI-DSS compliance and SOC 2 are treated as readiness and strategy, not completed certifications. We build to those frameworks — auth, RBAC, encryption at rest and in transit, rate limiting, audit logging, and fraud prevention — but do not claim certification that has not been formally issued.
Found a vulnerability? Reach the team through your merchant or developer account so we can triage and respond. Live component health is published on the status page.