Secure Bitcoin Storage - River Financial

Security Philosophy

Raising the bar by setting a new standard of best
practices within the industry.

Layered Security

We implement layered security through the principle of least-privilege by applying tiered, role-based access controls to our production environment.

Trust-minimized Infrastructure

Rather than relying on application, operating system, and hardware level trust assumptions, we use physically isolated, self-hosted infrastructure to eradicate the potential for Spectre-class vulnerabilities.

We minimize trust and dependence on third-parties by restricting cloud infrastructure to host non-critical operations only.

Data is Nuclear Waste

The easiest data to secure is data that doesn’t exist. In practice, this means that we store the least amount of information possible for the shortest amount of time possible.

The data we do store is rigorously stored, managed, and disposed of with the utmost care.

Bitcoin Security

Hot Wallet

Our Bitcoin infrastructure is self-hosted and is physically located inside of military grade vaults in highly secure data center facilities. This significantly increases the difficulty for an attacker with physical access to the facility.

We never store any private keys in a public cloud.

Cold Storage

The vast majority of our bitcoin is kept offline in cold storage.

We require multiple signatures to withdraw funds from cold storage.

We use Bitcoin's native multisignature system so we can identify who authorized a transaction, this is superior to the majority of the industry who rely on Shamir's Secret Sharing Scheme which requires reconstituting the key shares, exposing the system to attack.

Infrastructure Security

Physical Controls

Our critical infrastructure is physically stored in military grade vaults (Class 5 IPS containers) with non-mechanical locks that require multi-person authentication.

Private keys are geographically distributed and non-digitally replicated to safeguard against region-wide catastrophic events.

Application Security

We follow best practices of modern web browser security by supporting HTTP Strict Transport Security (HSTS) and a Content Security Policy (CSP).

All traffic is encrypted in transit via TLS 1.3.

All application data is encrypted at rest with AES256-GCM.

Operational Security

Non-critical operations leverage cloud infrastructure that has undergone SOC 2 Type II examinations.

We use Google Cloud’s DDoS detection and traffic filter to guard against denial of service attacks.

Security sensitive services are physically isolated on separate machines to defend against Spectre-class vulnerabilities.

We’ve built an integrated monitoring system to automatically detect, alert, and mitigate potential attacks.

Your Account Security Features

We require multi-factor authentication (MFA) upon account creation. At least one of the following MFA methods are required:

TOTP (e.g. Google Authenticator, 1Password, Duo)

SMS/Text (Not recommended)

Your passwords are hashed via bcrypt with a work factor of 14.

Internal Controls

Organization

We don’t keep anything of value in the office.

Employees must use separate passwords and multifactor authentication with each device and service.

Employees have limited access to personal identifiable information.

Access to cold storage keys requires traveling to multiple geographically dispersed locations.

Code

Code commits must be signed and are never merged without review.

Code deployments require review from multiple parties.

Security is
Who we are

We do not compromise when it
comes to securing your Bitcoin.