> For the complete documentation index, see [llms.txt](https://docs.clickoptions.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.clickoptions.ai/trust/security-and-custody.md).

# Security and Custody

ClickOptions follows institutional-grade security practices to keep client funds, Vault capital and protocol operations safe. Custody risk is actively managed and controlled — it is not eliminated.

#### **Asset Segregation**

* **Client funds** are held in platform-controlled wallets under documented multisignature and operational controls, segregated from ClickOptions’ operational treasury.
* **Vault capital** (roadmap) is designed to be isolated in smart contracts, separate from operational funds.
* Segregation is designed so that client withdrawals and option settlements remain unaffected by ClickOptions’ own finances.

#### **Key Management & Multisignature**

* Treasury and reserve wallets are secured with **multisignature controls**; signing requires threshold approvals and no single party holds unilateral control.
* Hot/warm operational wallets are kept minimal and separated from cold reserves.
* Withdrawal authorisation follows a defined approval and compliance workflow.

#### **Key Ceremonies**

* Formal **key-generation ceremonies** are conducted for treasury and reserve keys under documented procedures.
* Any future Vault smart contracts follow a separate deployment key-ceremony process, overseen by ClickOptions and independent auditors.
* Keys are rotated periodically and following any security event.

#### **Penetration Testing & Audits**

* ClickOptions commissions regular **penetration tests** on its trading infrastructure, covering application, network and cloud layers.
* **Independent smart-contract audits** are a pre-listing commitment for all on-chain modules before deployment (see Audits and Reports).
* A **bug bounty program** is planned to incentivise responsible vulnerability disclosure.

#### **Secure Development Lifecycle (SDLC)**

* Development follows a **secure software lifecycle** with:
  * Peer code reviews.
  * Automated security scans.
  * Continuous integration pipelines with inline security checks.
  * Role-based access for production deployments.
* **Threat modeling** is applied for every new feature.

> A move to third-party qualified custody may be introduced in a later phase. Any such arrangement, and any related certification, will be disclosed once contracted.