Security

Platform & smart-contract security

Libertum secures T-Suite in layers: independent testing by Hashlock, compliance enforced on-chain by the token standards it issues, platform-managed custodian wallets with encrypted keys and protected withdrawals, and role-based access to the platform. This page sets out what has been tested, how, and the limits of those assurances.

Last updated:

This page describes Libertum’s security controls at a high level. Audits and penetration tests are point-in-time assessments of the scope stated in each report; they are not a guarantee that a system is free of vulnerabilities. Nothing here is investment or legal advice.

Has Libertum been independently tested?

In October 2025, Hashlock carried out an independent blackbox penetration test of the T-Suite web applications — the admin, investor, issuer and transfer-agent portals, tested in Libertum’s sandbox environment — the fourth penetration test Hashlock has performed for Libertum. Security rating: ‘Secure’, with no critical or high-severity findings; 2 medium, 1 low and 1 QA, all resolved or acknowledged. See the penetration-test report. Hashlock has also audited Libertum’s smart contracts: see the smart-contract audit report and the bonding smart-contract audit report, listed on Hashlock’s audits page.

Each report covers the scope and the point in time it states. We publish the reports so that you can read the scope and findings for yourself.

How do Libertum's smart contracts enforce compliance?

For the standards that support it, compliance is enforced on-chain by the token itself, not only by the platform. See token standards and compliance.

  • ERC-3643 (T-REX) on EVM networks: a token only moves between wallets whose owners have a verified on-chain identity in the token’s Identity Registry, and only when every compliance rule allows it. Permissioned gateways mean only authorised signers can deploy token suites and identities.
  • CIP-113 on Cardano: programmable tokens whose transfer rules are enforced by on-chain scripts. Libertum runs on the Cardano Foundation’s canonical CIP-113 core (v0.0.1), live on mainnet since 5 October 2026, and adds its own on-chain compliance modules.
  • XRP Ledger: for issued currencies, a holder’s trust line must be authorised before the holder can receive the token; XLS-33 MPTs use issuer-authorised holders. Credentials and a Permissioned Domain gate secondary trading to credentialed holders.
  • Issuer-controlled compliance actions per standard: freeze, unfreeze, forced transfer and recovery on ERC-3643; freeze, seize and forced transfer on CIP-113; clawback on XRPL issued currencies.
  • Verified contracts: deployed EVM contracts are verified on block explorers, so anyone can read the source code they run.

ERC-20, ERC-721, CIP-20 and plain XRPL issued currencies do not enforce compliance in the token itself; Libertum gates them at the marketplace level instead.

How are custodian wallets protected?

T-Suite includes platform-managed custodian wallets for investors and issuers, so they can hold and move assets without running their own wallet software.

  • Every custodian wallet’s private key is encrypted per wallet with AES-256-GCM.
  • A platform-wide signing pause can stop all signing at once, and individual wallets can be locked from signing.
  • Every signing operation the platform initiates is recorded in an audit log.
  • Every withdrawal must be confirmed with a single-use code, either emailed for that withdrawal or taken from the user’s authenticator app (or a backup code).
  • Investors’ network fees are sponsored at custodian checkout and billed to the offering’s issuer, so investors do not need to hold gas tokens to invest.

How is access to the platform controlled?

  • Role-based permissions per organisation: an owner, admins and custom roles decide who can see and do what.
  • Two-factor login with an authenticator app and backup codes.
  • Automatic session expiry after a period of inactivity.
  • Signed requests: service-to-service and admin API calls are signed with HMAC.
  • Edge protection for the platform through Cloudflare.
  • Error monitoring that scrubs credentials and personal data from error reports before they are stored.

How is investor data protected?

  • Identity verification (KYC and KYB) runs through SumSub, a specialist identity-verification provider.
  • Libertum never sells investor data.
  • How personal data is collected, used and kept is set out in our privacy policy and cookie policy.

Is Libertum regulated?

Libertum operates through regulated entities. Libertum, S.A. de C.V. is registered with El Salvador’s CNAD as a Digital Asset Service Provider (registry entry PSAD-0094) for custody, exchange and transfer of USDT and USDC and receipt and transmission of client orders, with RLUSD custody approved. It is a CNAD-supervised entity, and the registration covers these services in El Salvador; it does not cover custody of security tokens and does not authorise issuance. Libertum LLC is registered with FinCEN as a Money Services Business. See licences.

What are the limits of these assurances?

  • Libertum is not currently certified under SOC 2 or ISO 27001.
  • Audits and penetration tests are point-in-time: they cover the scope and the date stated in each report.
  • The penetration test covered the T-Suite web applications; it is not an assessment of every system Libertum uses.

How do I report a vulnerability?

  1. 01

    Email us

    Write to [email protected] with the subject “Security”, and include what you found and how to reproduce it.

  2. 02

    Give us time to fix it

    Please allow us a reasonable time to investigate and fix the issue before disclosing it publicly.

  3. 03

    Test responsibly

    Do not run tests that harm users, access or change other people’s data, or degrade the service. We do not currently run a paid bug-bounty programme.

Related

Frequently asked questions

Has Libertum been penetration tested?

Yes. In October 2025, Hashlock carried out an independent blackbox penetration test of the T-Suite web applications (admin, investor, issuer and transfer-agent portals), rated ‘Secure’ with no critical or high-severity findings; 2 medium, 1 low and 1 QA, all resolved or acknowledged. It is the fourth penetration test Hashlock has performed for Libertum. See the report.

Are Libertum's smart contracts audited?

Yes. Hashlock has audited Libertum’s smart contracts: see the smart-contract audit report and the bonding smart-contract audit report, listed on Hashlock’s audits page.

How are investor wallets protected?

Each custodian wallet’s private key is encrypted individually with AES-256-GCM. The platform can pause all signing or lock an individual wallet, every platform-initiated signing operation is recorded in an audit log, and every withdrawal must be confirmed with a single-use code, emailed for that withdrawal or from the user’s authenticator app.

Do investors pay network fees?

Not at custodian checkout: when an investor pays from the custodian balance, network fees are sponsored and billed to the offering’s issuer.

How do I report a vulnerability?

Email [email protected] with the subject “Security”. Please give us reasonable time to fix the issue before disclosing it, and do not run tests that harm users, their data or the service.

Is Libertum regulated?

Libertum, S.A. de C.V. is a CNAD-registered and supervised Digital Asset Service Provider in El Salvador (PSAD-0094) for the services listed on our licences page, which it provides in El Salvador. Libertum LLC is registered with FinCEN as a Money Services Business. These registrations do not authorise Libertum to issue securities.

Is Libertum SOC 2 or ISO 27001 certified?

Libertum is not currently certified under SOC 2 or ISO 27001. Its independent assurance today comes from Hashlock’s testing and audits described on this page.

Sources

Last checked:

  1. Libertum docs: Token standards — ERC-3643 identity registry and agent roles; CIP-113 canonical core; XRPL authorisation
  2. Libertum docs: Custodian Wallet — Custodian wallets and sponsored gas at custodian checkout
  3. Libertum docs: Licences — DASP registration PSAD-0094 scope and limits
  4. Hashlock: Libertum audits — Hashlock's audits and tests for Libertum
  5. Hashlock: blackbox penetration-test report — Oct 2025 test; T-Suite web applications; rated 'Secure'
  6. Hashlock: Libertum smart-contract audit report
  7. Hashlock: Libertum bonding smart-contract audit report

Questions about security?

Talk to our team about how T-Suite protects your offering, your investors and their assets.

See our licences