/security
Read-only by design
MerkleBooks only needs public addresses. We never request signatures, private keys or wallet connections that can move funds.
Architecture
- Public chain data only — read through RPC providers, no signing ever.
- Workspace data encrypted at rest (AES-256) and in transit (TLS 1.3).
- Sealed periods are append-only; changes create a new version, never edits.
- Role-based access: owner, accountant, reviewer, external auditor.
Compliance roadmap
| Control | Status |
|---|---|
| SOC 2 Type I | In progress |
| SOC 2 Type II | Planned |
| GDPR data processing agreement | Available on request |
| EU / US data residency | Enterprise |
Responsible disclosure
Found a vulnerability? Email security@merklebooks.com. We reply within 2 business days and credit researchers who report in good faith.