> For the complete documentation index, see [llms.txt](https://docs.clickoptions.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.clickoptions.ai/trust/security-and-custody.md).

# Security and Custody

ClickOptions follows institutional-grade security practices to keep client funds, Vault capital and protocol operations safe. Custody risk is actively managed and controlled — it is not eliminated.

#### **Asset Segregation**

* **Client funds** are held in platform-controlled wallets under documented multisignature and operational controls, segregated from ClickOptions’ operational treasury.
* **Vault capital** (roadmap) is designed to be isolated in smart contracts, separate from operational funds.
* Segregation is designed so that client withdrawals and option settlements remain unaffected by ClickOptions’ own finances.

#### **Key Management & Multisignature**

* Treasury and reserve wallets are secured with **multisignature controls**; signing requires threshold approvals and no single party holds unilateral control.
* Hot/warm operational wallets are kept minimal and separated from cold reserves.
* Withdrawal authorisation follows a defined approval and compliance workflow.

#### **Key Ceremonies**

* Formal **key-generation ceremonies** are conducted for treasury and reserve keys under documented procedures.
* Any future Vault smart contracts follow a separate deployment key-ceremony process, overseen by ClickOptions and independent auditors.
* Keys are rotated periodically and following any security event.

#### **Penetration Testing & Audits**

* ClickOptions commissions regular **penetration tests** on its trading infrastructure, covering application, network and cloud layers.
* **Independent smart-contract audits** are a pre-listing commitment for all on-chain modules before deployment (see Audits and Reports).
* A **bug bounty program** is planned to incentivise responsible vulnerability disclosure.

#### **Secure Development Lifecycle (SDLC)**

* Development follows a **secure software lifecycle** with:
  * Peer code reviews.
  * Automated security scans.
  * Continuous integration pipelines with inline security checks.
  * Role-based access for production deployments.
* **Threat modeling** is applied for every new feature.

> A move to third-party qualified custody may be introduced in a later phase. Any such arrangement, and any related certification, will be disclosed once contracted.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.clickoptions.ai/trust/security-and-custody.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.