Ecosystem Security

The fundamental security property of the system dictates that user private keys never leave the user's device. The architecture delegates all signing authority exclusively to the frontend environment, communicating directly with the user's locally installed wallet extension.

The backend infrastructure is structurally incapable of initiating a transfer or altering an escrow state unilaterally. Its operational scope is strictly confined to fetching on-chain state, generating unsigned transaction envelopes, forwarding them to the client for authorization, and relaying the resulting cryptographic signatures to the network. Consequently, even a total compromise of backend services cannot result in the unauthorized extraction of user funds.

Identity verification (Know Your Customer) requires the handling of highly sensitive personally identifiable information (PII). Rather than internalizing this risk, the architecture delegates biometric scanning and document verification entirely to Didit, a specialized and compliant decentralized identity provider.

During the onboarding process, the backend initializes a secure session and redirects the user to Didit's hosted infrastructure. Upon completion, Didit transmits a signed webhook containing only the binary resolution of the verification (Approved or Declined). The backend persists only this status flag and an anonymized session identifier. Raw biometric data and passport images are never processed, transmitted, or stored within the internal system boundaries.

While the smart contracts managing the escrows are self-executing and immune to backend manipulation, the P2P protocol must account for scenarios where fiat settlements are contested. To address this, the Trustless Work integration provisions a designated resolver role within the contract initialization parameters.

This role allows a segregated platform support key to intervene exclusively in the event of a dispute. The resolution process relies entirely on the objective evaluation of the unstructured payment evidence uploaded by the buyer to the object storage service. By enforcing resolution through the contract's defined mechanics rather than an administrative backdoor, the cryptographic guarantee that funds cannot be arbitrarily moved remains intact.

In addition to architectural compartmentalization, the platform employs defense-in-depth strategies at the network layer. Authentication is governed by short-lived JSON Web Tokens (JWT) issued only after a successful cryptographic challenge proving wallet ownership.

Furthermore, both frontend and backend services are deployed in isolated Docker containers via Google Cloud Run, separating compute domains. The backend API enforces stringent Cross-Origin Resource Sharing (CORS) policies, supplemented by Google Cloud IAM controls, ensuring that only the official frontend domain possesses the authority to invoke backend operations.