We process millions in transactions daily. Not a single satoshi has been lost to a security breach. Here's how we keep it that way.
Our security model follows a defense-in-depth strategy with multiple independent layers of protection. No single point of failure can compromise user funds.
All hot wallets require 3-of-5 signatures to authorize any outgoing transaction. Keys are held by different senior engineers in separate physical locations.
Over 95% of all crypto assets are held in air-gapped cold wallets that have never touched the internet. Withdrawals require a 48-hour timelock.
Our ML-powered engine analyzes 10,000+ events per second, looking for unusual patterns, device anomalies, and known attack vectors.
Zero public-facing servers. All API traffic flows through Cloudflare with strict WAF rules. Private VPC with zero-trust networking.
Mandatory KYC for all users. Biometric 2FA, TOTP support, and device management. BVN verification for all crypto-to-fiat transactions.
Licensed by the CBN and SEC. Annual SOC 2 Type II audits. Smart contracts audited by CertiK and Trail of Bits.
Security is a partnership. While we handle the infrastructure, there are steps you can take to keep your account safe from phishing, social engineering, and unauthorized access.
Found a vulnerability? We operate a responsible disclosure program. Report security issues to our team and receive recognition and rewards.
Folaa is a fintech company, not a bank, so deposits are not covered by NDIC insurance. However, we maintain a capital reserve that exceeds regulatory requirements, and 95% of crypto assets are held in cold storage. We also carry a comprehensive crime insurance policy that covers theft, fraud, and cyber attacks.
Our defense-in-depth architecture means a single breach cannot compromise funds. Even if our servers were compromised, attackers would need 3-of-5 private keys (held offline) plus biometric approval to move any assets. In the unlikely event of a loss, our crime insurance policy covers user funds up to ₦500 million.
We use a tiered KYC system. Level 1 requires BVN verification and a selfie. Level 2 (required for transactions above ₦500,000) requires a government-issued ID and proof of address. All documents are encrypted and stored in compliance with NDPR (Nigeria Data Protection Regulation).
Unfortunately, crypto transactions are irreversible. If you send USDT to the wrong network (e.g., ERC20 to a TRC20 address), we cannot recover those funds. This is why we display prominent warnings and require network confirmation before displaying deposit addresses. Always double-check the network before sending.
Only authorized personnel with a business need can access user data. All access is logged and audited. We never sell your data to third parties. We share data only with regulated banking partners (for transaction processing) and law enforcement (when legally required with a valid court order).
Our incident response plan is tested quarterly. In the unlikely event of a security incident, we follow a strict protocol to detect, contain, and communicate.
Join 200,000+ Nigerians who trust Folaa with their crypto, bills, and daily transactions.
