> For the complete documentation index, see [llms.txt](https://docs.zoth.io/zoth/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zoth.io/zoth/zpayments/security-of-zpayments.md).

# Security of zPayments

### **Custody security**

USDC is held in a segregated wallet on ForDefi, secured by multi-party computation with three of five signatures required to move funds. No single person holds a complete signing key.

| **Control**       | **Detail**                                                                       |
| ----------------- | -------------------------------------------------------------------------------- |
| Custody           | Segregated MPC wallet on ForDefi, three-of-five signing                          |
| Deposit sources   | Only wallet addresses recorded and verified at onboarding                        |
| Deposit detection | On-chain listener, monitored continuously                                        |
| Wallet screening  | Blockchain analytics on every wallet, run on Chainalysis at the Zoth group level |
| Threat monitoring | Real-time monitoring by Cyvers                                                   |
| Audits            | Contracts audited by Entersoft                                                   |

### **Operational security**

Six control pairs run across the platform on a maker and checker basis. In each pair the person who performs an action and the person who approves it must be different people. Applied to a payout, the person who creates a transaction is never the person who approves it, and neither is the person who reconciles it.

Six functions are held by different teams: customer onboarding, transaction execution, settlement, monitoring, systems administration and audit. No employee controls onboarding, approval, execution and settlement at the same time.

Activity is written to an immutable, tamper-evident log. Each entry records the user, the time, the source IP address, the action taken, the previous value, the new value and any approval given.