Non-Custodial Account Isolation
Balances are held directly on the Base distributed ledger. RAVOT operates zero pooled reserves, ensuring assets remain in the direct cryptographic control of account holders.
Hardened MFA & Passkeys
Mandatory multi-factor authentication (TOTP RFC 6238) and passkey verification protect account operations and sensitive balance actions against credential attacks.
Zero-Trust Session Architecture
Cryptographically signed, HTTP-only session tokens are partitioned with strict SameSite and Secure flags, incorporating automatic idle timeouts and immediate revocation.
Transport & Storage Encryption
All traffic is secured via TLS 1.3 with strict Forward Secrecy. Database records, credentials, and configuration secrets are safeguarded with AES-256 encryption at rest.
Defense-in-Depth Architecture
At RAVOT, security is not a compliance checklist or an isolated department—it is the structural blueprint of our engineering lifecycle. Our platform implements defense-in-depth principles across every tier: network routing, application runtime, session boundaries, and blockchain protocol interfaces.
By combining a non-custodial blockchain foundation with hardened enterprise application controls, we eliminate single points of operational failure.
Authentication Standards & TOTP Multi-Factor Verification
Authentication to the RAVOT platform employs strict cryptographic standards:
- Zero Plaintext Storage: Passwords undergo salted key-derivation hashing before storage; plaintext credentials are never written to disk or logs.
- Time-based One-Time Passwords (TOTP): Fully compliant with RFC 6238, compatible with Google Authenticator, 1Password, and hardware authenticators.
- Account Lockout & Rate Limiting: Intelligent sliding-window rate limiting automatically throttles repeated failed attempts, preventing brute-force and credential stuffing attacks.
- Event-Driven Session Invalidation: Changing passwords or updating authentication factors instantly invalidates all active sessions across all devices.
Session Hardening & Cookie Isolation
Unlike legacy web applications that store sensitive authentication tokens in accessible browser localStorage (leaving them vulnerable to cross-site scripting attacks), RAVOT employs hardened HTTP-only cookies:
HttpOnly: Prevents malicious JavaScript or injected browser extensions from reading session secrets.Secure: Restricts token transmission exclusively to encrypted HTTPS connections.SameSite=Lax: Defends against Cross-Site Request Forgery (CSRF) exploits from untrusted external domains.- Cryptographic Tamper-Proofing: Session tokens are signed using high-entropy HMAC-SHA256 secrets rotated on automated schedules.
Infrastructure & HTTP Security Headers
Every response served by the RAVOT edge network enforces strict browser security directives:
All database interactions utilize typed Drizzle ORM query builders with parameterized inputs, providing total immunity against SQL injection vectors.
Blockchain Protocol & Base Layer 2 Settlement
RAVOT’s digital settlement architecture leverages the Base network, an Ethereum Layer 2 rollup built on the MIT-licensed OP Stack:
- Ethereum L1 Security Inheritance: Transaction data is posted to Ethereum Layer 1, inheriting the censorship resistance and settlement finality of the Ethereum validator set.
- Audited Token Implementations: Both USDC and EURC utilize audited, battle-tested smart contract implementations overseen by Circle.
- Cryptographic Preflight Checks: Transactions undergo client-side simulations and balance verification before on-chain submission, preventing accidental failed gas spends.
Security Checklist for Account Holders
We recommend all RAVOT account holders observe the following security practices:
Protect account operations with an authenticator app (1Password, Google Authenticator) in Account Settings.
Ensure your browser URL bar displays https://ravot.co before entering any credentials or signing transfers.
Use the balance privacy toggle to mask numerical account figures when transacting in public spaces.
Responsible Disclosure & Security Research
We welcome and value collaborative contributions from independent security researchers. If you identify a potential security vulnerability within our platform, APIs, or infrastructure, please disclose it responsibly:
Please include steps to reproduce, relevant HTTP requests or proof-of-concept code, and your PGP key for encrypted communications. We commit to acknowledging reports within 24 hours.
Safe Harbor: We will not pursue legal action against researchers who discover and report vulnerabilities in good faith, avoid privacy violations, and refrain from degrading production system performance.
Regulatory Disclosure & Architecture Status
RAVOT Technologies Ltd. is a financial technology software provider and digital interface, not a chartered bank, insured depository, or fiduciary. Account balances are maintained directly as digital currency tokens (USDC and EURC) on the Base distributed ledger network. Balances held via the RAVOT software are not insured by the FDIC, SIPC, FSCS, or any governmental deposit guarantee scheme. Users maintain direct cryptographic authority over their assets.