Trust & Security

Akashi asks you to sign transactions that move real money. This page sets out how the architecture limits what the interface can do with your funds, the controls that run on every change to it, and how to reach us about a security issue.

1. Non-custodial by design

The strongest security property Akashi has is structural rather than procedural: your funds never pass through it, and it cannot move them. Deposits go from your wallet directly to the venue you chose. Akashi holds no balances, no private keys, and no signing authority of any kind.

Concretely, the backend only ever assembles unsigned transaction instructions. Your wallet reviews and signs them, and your wallet submits them. There is no code path — none, by design and enforced in review — through which a server can sign anything. Connecting a wallet to Akashi is a read-only action.

The practical consequence is worth stating plainly: if Akashi were unavailable tomorrow, your positions would be unaffected and withdrawable directly from the venues holding them. More on how this works.

2. Controls on every change

• Security review before release. Changes are reviewed with particular attention to the boundary above — that nothing server-side can reach a private key or sign a transaction.
• Automated secret scanning. Every pull request is scanned for credentials and keys, and the scan blocks the merge. This one is continuous and enforced, not a point-in-time check.
• Automated test suite. Runs on every change, and a green run is required to merge.
• Transaction rehearsals. An end-to-end suite builds and simulates real transactions against live protocols, so integration breakage surfaces before a user meets it.

3. Protocol risk and interface risk are separate

Risk grades on this site take a venue’s own security history into account, so an opportunity can carry a strong grade on a well-established protocol. That is a statement about the protocol holding your deposit. It is a different question from the interface you are reading it on, and the two should be assessed separately — Akashi does not present a venue’s standing as its own.

4. Reporting a security issue

Email security@akashi.finance, the address published in our security.txt. Please include enough detail to reproduce the issue, and allow us time to ship a fix before disclosing publicly. Reports are read and taken seriously.

5. Support

For anything not security-sensitive — questions, data corrections, feature requests — write to support@akashi.finance or use the feedback form.

6. Scope — what Akashi does and does not do

• It never takes custody of funds and never holds private keys.
• It never signs or submits a transaction — your wallet does, every time.
• It reports rates, it does not set or guarantee them. A displayed rate is the venue’s rate at the time it was read; see data sources.
• A risk grade is Akashi’s own assessment, published with its reasoning and its limits in the methodology. It is not investment advice.
• DeFi carries smart-contract, peg and market risk that no interface can remove. Those risks remain yours.