What we can prove today, what we're working on, and how you (or your auditor) can independently verify each claim. Nothing on this page is aspirational — every "live" row links to a runnable verification.
| Attestation | Verification | Status |
|---|---|---|
| Hash-chained event log — every mutation recorded row-level SHA-256 chain | GET /v1/audit/head · /verify demo |
Live |
| Merkle-batched roots — ~60 s cadence, OpenZeppelin sorted-pair SHA-256 | GET /v1/audit/root · GET /v1/audit/proof/{seq} |
Live |
| R2 anchor — every batch published to Cloudflare R2 with HMAC signature | GET /v1/audit/batches · public R2 bucket pax-audit-batches |
Live |
| Polygon anchor — monthly Merkle root committed to on-chain contract | GET /v1/audit/anchor · Polygonscan contract page |
Live |
| OFAC sanctions screening — every payout wallet checked against SDN + Consolidated lists | GET /v1/admin/sanctions/{addr} (admin only) |
Live |
| 24-hour whitelist time-lock — every new payout wallet enforced before first payout | Wallet usable_from_ms field · Portal display |
Live |
| Reserve balance policy — 7-day dispute window before payout ready | GET /v1/builders/me/pending-balance shows reserved_in_window |
Live |
| Multi-approver policy — payouts ≥ $10,000 require 2 distinct admin approvers | POST /v1/admin/payout-batches/{id}/approve · audit log |
Live |
| Kill switch — 4 scopes (all / hot / cold / new-wallet-registration) with audit trail | GET /v1/admin/kill-switch |
Live |
CSP hardened — script-src 'self' on all SPAs, no unsafe-inline |
curl -sI https://builder.predictasiax.com/ |
Live |
| Attestation | Target | Blocker |
|---|---|---|
| Chainalysis KYT — transaction risk scoring (mixer, ransomware, darknet) | Q4 2026 | Chainalysis contract signature |
| Travel Rule (FATF) — recipient beneficiary capture for transfers ≥ $1,000 | Q4 2026 | Provisions documented, wire in Portal + Worker |
| SOC 2 Type II — 6-month observation period + external audit | H1 2027 | Observation period start; auditor selection |
| ISO 27001 — information security management system certification | H1 2027 | Consultant engagement, in parallel with SOC 2 |
| Proof of reserves — periodic public disclosure of USDT float vs liabilities | Q1 2027 | Onboarded LP / market-maker balance reporting |
| MPC signer (Fireblocks or ZenGo) — replace single hot-wallet key with threshold signing | Q1 2027 | Vendor selection, integration cost analysis |
| Jurisdiction licensing (SG, JP) — pursue regulatory clarity for Asia operating footprint | 2027 | Legal counsel engaged; region-by-region |
See /geographic-availability for the current allowed / restricted / prohibited list. This page is updated in-sync with any regulatory action affecting user or builder access.
If an incident happens, we publish a post-mortem within 7 days: what broke, when, what data was affected (if any), what we changed. Post-mortems live in the changelog tagged [incident]. Real-time status at status.predictasiax.com.