Account and access security
Account takeover remains one of the most direct threats in digital finance. NPX designs account security around the assumption that credentials can be compromised. Multi-factor authentication adds a second factor that a stolen password cannot satisfy. Anomalous login detection compares device, location, network and behavioral signals against expected patterns, and can require additional verification when the risk score rises.
Sensitive actions — changing security settings, adding withdrawal addresses or executing large transfers — require secondary confirmation. This reduces the chance that a compromised session can immediately convert access into asset loss. Session management, device review and clear login history give users visibility into activity on their accounts.
Withdrawal review and transaction monitoring
Withdrawals are a critical control point. NPX applies risk-based review that considers account history, device signals, destination address behavior and broader transaction patterns. Reviews are designed to be proportionate: ordinary activity should proceed smoothly, while unusual activity receives additional scrutiny.
Real-time transaction monitoring looks for patterns associated with account hijacking, unauthorized actions, irregular fund flows and other suspicious behavior. Alerts are investigated through a defined process, with records retained for review and regulatory purposes. Where required, suspicious activity is reported to the appropriate authorities under applicable law.
Asset management boundaries
NPX is committed to maintaining clear operational boundaries between user assets and corporate operating funds, supported by an asset management framework designed to be transparent, standardized and verifiable. Wallet management, key custody and transfer authorization follow documented procedures with segregation of duties.
The platform continues to strengthen internal access management and risk response mechanisms to mitigate account hijacking, unauthorized operations, system attacks and irregular capital movements. Access to production systems is limited, logged and reviewed, with multi-party approval for critical operations.
Internal controls and multi-party approval
Insider risk is addressed through institutional design rather than trust alone. NPX emphasizes hierarchical delegation of authority and multi-party approval for critical operations, so that no single individual or access right holds excessive control over vital systems or key processes. Tiered internal access rights limit what each role can see and do.
Data encryption protects information in transit and at rest. Access to sensitive data is restricted by role and logged. Periodic access reviews confirm that permissions still match responsibilities, and that departed or reassigned staff no longer retain access.
System stability as a security property
Availability is part of security. A platform that becomes unavailable during market stress can prevent users from managing risk precisely when management matters most. NPX continuously improves response efficiency, order-matching capabilities, market data update speed, execution quality and resilience under extreme conditions.
The objective is to minimize the impact of network latency, system congestion and abnormal market volatility on the user experience, while preserving the integrity of accounts and records. Failover procedures and incident runbooks are maintained and tested, and post-incident reviews identify root causes rather than only symptoms.
| Threat | Primary controls | Layer |
|---|---|---|
| Credential compromise | Multi-factor authentication, anomaly detection, session review | Account |
| Unauthorized withdrawal | Secondary confirmation, risk-based review, address controls | Transaction |
| Insider access | Tiered permissions, multi-party approval, access reviews | Internal |
| Data exposure | Encryption, role-based access, logging | Data |
| Service disruption | Redundancy, load testing, incident response | System |
What users should do
- Use a unique password and enable multi-factor authentication.
- Verify withdrawal addresses before confirming a transfer.
- Review login history and security notifications regularly.
- Be cautious with unsolicited messages requesting credentials or remote access.
- Understand that blockchain transactions are generally irreversible.
Honest disclosure
NPX commits to providing accurate disclosures about security mechanisms and operational measures that have been implemented and verified. It will not present features that are still under development, unverified or unsupported by evidence as fully realized. Security claims should be specific, testable and consistent with what users can observe.