OIDC + PKCE behind a BFF
Keycloak issues tokens; a backend-for-frontend keeps them server-side in an HTTP-only session. The browser holds a session cookie, never a bearer token — so an XSS bug can't walk off with your credentials.
Security & Trust
Built to be trusted with the deal
A trade platform earns trust by design, not by promise. Dealium never holds your funds, never lets the browser hold a token, requires two operators to release funds above a set threshold, and never sends your data to a model we don't run. Here is exactly how — including what is built, what is configuration-gated, and what is still on the roadmap.
Non-custodial by design
EU-hosted & encrypted
Self-hosted AI
Append-only audit
OWASP / ASVS internal audit
Jump to: No-custody model · Identity · Money-path controls · Compliance · Data · AI governance · Practices & roadmap
01 · The no-custody model
The safest money is the money we never touch
Every platform that tried to hold trade money inherited three problems at once: custody risk, a money-transmitter licensing burden, and a balance sheet regulators can freeze. Dealium sidesteps all three by never holding a cent. It orchestrates the deal and instructs a licensed provider to move funds — only when you approve, and only when the terms are met.
Why not touching the money makes you safer
- No custody risk. Your money is never on Dealium's books, so it can't be lost, commingled, or frozen with Dealium.
- No licensing single point of failure. Regulated movement stays with the licensed rail that specializes in it — not with a software vendor holding a patchwork of money-transmitter licenses.
- Instruct, don't intermediate. Dealium computes whether the terms are met and issues a release instruction; the rail executes the transfer.
- Provider-agnostic. Bring the licensed rail you already trust — Dealium is the control layer above it, not a replacement bank.
Plainly: Dealium is a software provider — not a bank, payment institution, or escrow agent. "Payment control" and "conditional release" describe orchestration, never custody.
Eight payment rails sit behind one interface (three fiat rails — WorldFirst, Bridge, Airwallex — are the exposed set). The same non-custodial rule applies to every one.
02 · Identity & access
Who you are is verified before what you can do is decided
Authentication runs on Keycloak (OpenID Connect) with PKCE, behind a backend-for-frontend. The token lives in a server-side session, so the browser never holds one — closing off the most common way access tokens leak.
MFA & enterprise SSO
Because identity is delegated to Keycloak, multi-factor authentication and SSO federation (SAML / OIDC to your IdP) are configuration, not custom code — enforced consistently for every user in your org.
3-axis, 8-role RBAC
Authorization is decided on three axes at once — org type, deal position, and platform role — across eight roles. A user's rights are the intersection, not a single flat label, which is what closed a real cross-tenant privilege-escalation class in our own audit.
Multi-tenant isolation
Every record is scoped to its organization and deal. A party can only see the deals it is on and the counterparties it has been introduced to — enforced in the query layer, not just the UI.
Least privilege by default
Operators, arbitrators, compliance, and admin are distinct platform roles with narrow, purpose-built powers. No single account both runs the deal and settles the money.
Deactivation propagates
Disabling a user in Dealium propagates to the identity provider, so a revoked account can't keep an open session alive — access ends where you end it.
03 · Money-path controls
Even instructing a release takes two people and leaves a permanent mark
Dealium doesn't hold funds — but the instruction to move them is the most sensitive action on the platform, so it is wrapped in maker/checker separation, hard caps, structuring detection, and an immutable ledger.
Two-operator maker/checker release
The operator who prepares a release can't be the one who approves it. A second, separate operator must confirm — separation of duties in code, above a configurable threshold.
Over-release caps
You can never instruct out more than was deposited and held for a deal. The engine hard-caps releases against the funded amount, so a fat-fingered or malicious instruction can't overpay.
Anti-structuring checks
Payments are watched for splitting patterns designed to slip under approval or reporting thresholds. Suspicious sequences are flagged rather than quietly executed.
Immutable, append-only ledger
Every deposit, hold, approval, and release is written to an append-only payment-event ledger. Records are added, never edited or deleted — so the money story of a deal can always be reconstructed.
On-chain finality checks
For crypto-settled rails, a finality watcher confirms the transaction is irreversibly settled on-chain before the deal treats it as complete — no acting on an unconfirmed transfer. (Crypto rails are built; the exposed rails today are fiat.)
Disputes freeze the funds
Opening a dispute holds the money in place. A neutral platform arbitrator — never the counterparty — resolves it against an immutable decision record with SLA timers.
Release above the maker/checker threshold is gated on funded balance, both approvals, and a passing conditions check — enforced with row-locking to prevent time-of-check/time-of-use races.
04 · Compliance in the flow
Compliance is a gate you pass through, not a form you file after
KYB/AML and sanctions/PEP screening are wired into the deal itself. They gate two moments that matter: accepting a deal and moving money. If a party isn't cleared, the deal can't advance and no release can be instructed.
Two gates, one flow
Screening isn't a one-time stamp. Parties are re-screened over the life of a relationship, so a counterparty that becomes sanctioned after onboarding is caught before the next release.
- KYB & UBO discovery. Business-registry verification and ultimate-beneficial-owner mapping establish who you're really trading with.
- Sanctions & PEP screening. Parties are checked against sanctions and politically-exposed-person lists before a deal can be accepted.
- Deterministic, explainable risk engine. CDD/EDD risk is scored by explicit rules, not an opaque model. Every factor that moved a score is logged, so a decision can be explained to a regulator or an auditor.
- Ongoing re-screening. Cleared status is continuously re-checked — trust is re-earned, not assumed forever.
- Gates acceptance and payment. Both the deal-acceptance and the release path check the cleared-to-trade status — you can't route around it.
Honest note: the strictest compliance and CSRF enforcement are configuration-gated (dark-launched behind flags) so they can be staged safely. Real-world assurance depends on these being switched on in the production configuration — see the roadmap below.
05 · Data protection
Your documents are EU-hosted, encrypted, fingerprinted, and scanned
Trade documents are the evidence a deal is built on. Dealium treats them as immutable records: stored in the EU, encrypted, content-addressed by SHA-256, and scanned on the way in.
EU-hosted & encrypted
Data is hosted in the EU on an open-source stack, encrypted in transit and at rest. No trade document leaves the region for a third-party cloud service to inspect.
Immutable SHA-256 documents
Every document lands in a MinIO object store and is fingerprinted with SHA-256. If a single byte changes, the fingerprint changes — so a lab report or bill of lading can be proven identical to the one that was agreed.
ClamAV upload scanning
Files are scanned by ClamAV before they're accepted, so malware can't ride into a deal room on an uploaded document.
GDPR Article-17 erasure
The right to be forgotten is built in. Personal data can be erased on request under GDPR Article 17, while the immutable financial and audit record is preserved as the law allows.
Append-only audit trail
Every state change, document, and decision is written to an append-only audit log. Who did what, when, and to which version — reconstructable end to end for a dispute or an examiner.
Portable, not hostage
You're a customer, not a hostage. The stack is open-source and EU-hostable, and your records are yours to export — no lock-in built into the trust layer.
06 · AI governance
A copilot that checks and flags — and can't move a cent
Generic cloud contract-AI is a non-starter for a trade desk: it can leak your pricing and hallucinate figures. Dealium runs self-hosted open models, so your data never leaves the tenant — and the AI is advisory only.
- Self-hosted models. No public LLM, no cloud AI endpoint. Your pricing, counterparties, and documents never leave the tenant and never train an external model.
- Schema-validated & audited. Every one of the AI task types returns a validated schema, and every call is audit-logged — inputs, outputs, and who invoked it.
- Advisory only, never state-mutating. The copilot tells each of six roles what to look for and what to flag. It never approves a release, accepts a deal, or edits the ledger — humans decide.
- Rate-limited by design. AI endpoints are throttled, so a runaway or hostile caller can't turn the copilot into a denial-of-service or cost amplifier.
07 · Our practices & roadmap
What's done, what's gated, and what's still ahead
Trust is easiest to give to people who tell you what they haven't finished. Here is the honest state of Dealium's security program — pre-revenue, pre-live-payment, and deliberately transparent about it.
In place today
- Internal OWASP Top-10 2021 / ASVS v4 audit. An adversarial audit surfaced 23 findings; critical and high-severity issues were remediated and covered with regression tests.
- Regression-tested fixes. Security fixes ship with tests that fail if the vulnerability returns, backed by a broad backend test suite.
- CI security gates. Every change runs secret scanning (gitleaks), dependency audits (pip-audit, npm audit), and static analysis (Bandit) before it merges.
- Non-custodial architecture. The strongest control is structural: there is no pot of customer money to steal, because Dealium never holds one.
Planned · not done yet
- Independent third-party penetration test. Planned before Dealium instructs any live funds. Our internal audit is a floor, not a substitute for external testing.
- SOC 2 and ISO 27001. On the roadmap. We hold neither today and will not display a badge we haven't earned.
- Configuration-gated controls. Some controls — including the strict compliance gate and CSRF enforcement — are dark-launched behind flags. Their assurance depends on being enabled in the production configuration.
- No funds have moved in production. Payment rails are built but not yet live against a provider. We are pre-revenue and say so.
The posture at a glance
Every badge below describes something in the codebase today — no certifications we don't hold.
Non-custodial
We never hold, transmit, or convert funds.
OIDC + PKCE / BFF
Browser never holds a token.
Maker/checker
Two operators to instruct a release.
EU-hosted
Encrypted, in-region, open-source stack.
SHA-256 docs
Immutable, fingerprinted, ClamAV-scanned.
Append-only audit
Every state, doc, and decision logged.
Self-hosted AI
Data never leaves the tenant.
OWASP / ASVS
Internal audit, regression-tested.
08 · Straight answers
Frequently asked
Does Dealium ever hold my money?
No. Dealium is non-custodial. Funds move buyer → licensed payment rail → seller. Dealium only sends the release instruction once the agreed conditions are met; money never passes through Dealium's accounts or balance sheet. Dealium is a software provider, not a bank, payment institution, or escrow agent.
Is Dealium SOC 2 or ISO 27001 certified?
Not yet. Dealium has passed an internal OWASP Top-10 2021 / ASVS v4 adversarial audit with regression tests, and runs automated CI security gates. SOC 2 and ISO 27001 are on the roadmap, and an independent third-party penetration test is planned before Dealium handles live funds. We do not claim certifications we do not hold.
Does my data train an external AI model?
No. Dealium runs self-hosted open models. Your pricing, counterparties, and documents never leave the tenant and are never used to train an external or third-party model. Every AI call is schema-validated and audit-logged, and the AI is advisory-only — it never moves money or mutates deal state.
Read the model. Then test it on a real deal.
The best proof of a non-custodial platform is running one deal through it — the money stays in your control the whole way. Bring a live trade and we'll walk it with you.