Security Architecture

Operator and jurisdiction: BASIS is operated by BASIS DIGITAL INFRASTRUCTURE LTD, a Seychelles IBC (LEI: 254900IX2F2KCWNSSS64).

Accounting convention

Dashboard balances may be displayed in USDT as an internal accounting and reporting unit for USD-equivalent reference.

USDT is not a depositable or withdrawable asset on BASIS.

Deposits and withdrawals are supported in native assets only:

• BTC

• ETH

• SOL

• PAXG

Staking balances are represented as:

• stBTC

• stETH

• stSOL

• stPAXG

Security on BASIS is a system property. It includes identity controls, asset segregation, deterministic execution, operational access control, third-party dependency management, and internationally certified management controls.

BASIS operates with institutional-grade security and service governance aligned to internationally accredited standards. BASIS DIGITAL INFRASTRUCTURE LTD maintains active certification to ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018, with public verification available through IAF CertSearch.

The platform security model is designed around execution precision, structural alpha capture, and bounded state transitions. This means the system limits what can happen by design, rather than relying only on operator judgment after the fact.

Certification and governance

The BASIS control environment is supported by an active ISO/IEC 27001:2022 certification covering software design, quantitative research systems, associated IT infrastructure, and information security management.

Field	Details
Certificate Number	SC62455E
Standard	ISO/IEC 27001:2022
Status	Active
Last Updated	March 27, 2026
Certified Entity	BASIS DIGITAL INFRASTRUCTURE LTD
Address	Room 306, Victoria House, P.O Box 673, Victoria, Mahe, Seychelles
Scope	The Design and Development of Software and Quantitative Research Systems and the Management of Associated IT Infrastructure and Information Security
Accreditation	IAF (International Accreditation Forum)
Verification	Verify on IAF CertSearch

BASIS DIGITAL INFRASTRUCTURE LTD also maintains an active ISO/IEC 20000-1:2018 certification.

Standard	Certified Entity	Status	Public Verification
ISO/IEC 20000-1:2018	BASIS DIGITAL INFRASTRUCTURE LTD	Active	Verify on IAF CertSearch

Certified entity record: Entity Record on IAF CertSearch

These certifications reinforce the BASIS operating model by placing security and service management under documented controls, formal review, and externally verifiable governance.

1) User authentication: passwordless OTP

BASIS uses passwordless email OTP authentication. BASIS does not store user passwords.

Security property	Implementation
Authentication factor	6-digit OTP sent to the registered email
OTP validity	10 minutes, single-use
Concurrent sessions	Single Active Session Policy, each new login terminates the previous session
Login notifications	Every login event generates an automated email alert with IP, device, and timestamp
Brute force protection	Temporary lockout after 5 consecutive failed attempts

User hygiene still matters

• Protect your email account with a strong password and 2FA

• BASIS will never ask for private keys, seed phrases, or wallet recovery phrases

• Verify the domain is basis.pro before entering an OTP

• Official email communications use @basis.pro addresses only

Official web domain: basis.pro
Official email domain: @basis.pro

1.5) Execution security: BHLE and deterministic state control

The Base58 Hyper-Latency Engine, or BHLE, is the execution infrastructure behind BASIS. It is engineered for deterministic routing, execution precision, and structural alpha capture under tightly bounded risk controls.

Core execution characteristics:

• Sub-50μs decision latency

• 100K+ OPS processing capacity

• Proprietary routing infrastructure

• Deterministic execution paths

• Math-constrained state transitions

• Explicit stop conditions and circuit logic

• State machine risk controls that restrict invalid or out-of-policy actions

This architecture reduces discretionary behavior at the infrastructure layer. The objective is not only speed, but correctness under stress.

Key security properties:

• execution logic is separated from user-facing asset states

• allowable actions are constrained by product rules

• invalid transitions are rejected at the state-machine level

• risk controls can halt routing or settlement progression when constraints are breached

• structural alpha capture is pursued through deterministic routing logic, not through unrestricted operator intervention

Why this matters

A secure system should not depend on perfect human intervention. BASIS constrains the action space through deterministic rules so that wallet states, staking states, and withdrawal states remain machine-verifiable.

1

1. Deposit to Funding Wallet

Users deposit native assets only.

• BTC deposits use a unique BASIS-assigned address for each account

• ETH, SOL, and PAXG deposits require a connected Web3 wallet such as MetaMask or another supported wallet

• Minimum BTC deposit: 0.0001 BTC

2

2. Convert on a same-token basis

Swaps are same-token only and 1:1 between a native asset and its corresponding staking asset.

Examples:

• BTC ↔ stBTC

• ETH ↔ stETH

• SOL ↔ stSOL

• PAXG ↔ stPAXG

No cross-asset swaps are used in this flow.

3

3. Stake from the Staking Wallet

Staking positions are funded with stTokens only.

Rewards accumulate in real time as the same stToken in the Staking Wallet.

4

4. Unstake under explicit rules

Unstake is full-position only. The system uses an auto-MAX model.

For fixed pools, unstake is available only after the lock-up period ends. There is no early exit option.

5

5. Credit and withdraw

When unstake is completed, the claimable amount is auto-credited to the Staking Wallet as the same stToken.

Users can then convert on a same-token 1:1 basis and withdraw the native asset from the Funding Wallet.

2) Asset security: wallets and permissions

BASIS separates wallet functions at the product level:

Wallet	Holds	Primary actions	Security role
Funding Wallet	Native assets: BTC, ETH, SOL, PAXG	Deposit, withdraw, same-token conversion	Isolates settlement and transfer activity
Staking Wallet	stBTC, stETH, stSOL, stPAXG	Stake, earn, unstake, receive accrued rewards	Isolates earning states from transfer states

This separation is intentional. It reduces ambiguity in asset state, improves auditability, and limits the impact of invalid transitions.

Deposit model by asset type

BTC

BTC deposits are made by copying the unique BASIS-assigned deposit address shown for the account.

Security characteristics:

• no Web3 wallet connection is required for BTC deposits

• the deposit address is specific to the account

• minimum deposit is 0.0001 BTC

• inbound settlement is monitored before balances are credited

ETH / SOL / PAXG

Product state constraints

Action	Allowed behavior
Deposit	Native asset only
Swap	Same-token 1:1 only
Stake	stToken only
Rewards	Accumulate in real time as the same stToken
Unstake	Full position only
Fixed pool exit	Only after lock-up ends
Claim crediting	Auto-credited to Staking Wallet as stToken
Withdraw	Native asset only from the Funding Wallet flow

These rules are part of the security model. By narrowing valid state transitions, BASIS reduces operational ambiguity and unauthorized path expansion.

3) Operational security

Operational security includes:

• role-based access control

• environment segregation across development, staging, and production

• controlled deployment pipelines

• peer review and change management

• monitored infrastructure and alerting

• key and credential rotation policies

• incident response playbooks

• reconciliation and exception handling procedures

These controls are supported by BASIS's certified management systems for information security and IT service management. In practice, this means security and service operations are governed through documented controls, repeatable processes, and auditable oversight aligned with ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. The ISO/IEC 27001:2022 certification for BASIS DIGITAL INFRASTRUCTURE LTD is publicly verifiable under certificate number SC62455E.

BASIS also uses deterministic operational parameters so user-facing asset behavior is predictable and not manually repriced on a case-by-case basis.

Operational parameter	Rule
Deposit fee	0%
Withdrawal fee	0.05%
Swap fee	0.01%
BTC withdrawal time	Typically 30 minutes to 1 hour
ETH / SOL / PAXG withdrawal time	Typically 1 to 6 minutes

Fixed pools add another safety boundary. Positions cannot be exited before maturity, which prevents unsupported state changes during the lock period.

4) Third-party security

BASIS depends on external infrastructure for parts of settlement and execution, including:

• liquidity venues and exchanges

• public blockchain networks

• wallet providers for supported chains

• token issuers and settlement rails, including PAXG infrastructure

• market data and routing dependencies

Third-party risk controls include:

• venue risk scoring

• exposure limits

• fragmented liquidity sourcing

• monitored routing quality

• network health checks

• explicit stop conditions when settlement or market quality falls below policy thresholds

Security on BASIS does not assume that third parties are always healthy. It assumes that dependencies can degrade and that system behavior must remain bounded when they do.

5) What security cannot guarantee

Security architecture lowers the probability of certain failures. It does not eliminate:

• exchange insolvency or counterparty failure

• blockchain congestion, halts, or reorgs

• market dislocations and liquidity gaps

• external issuer or settlement risk, including PAXG-related dependencies

• reference pricing deviations in external markets, including USDT as a display benchmark

The practical objective is resilience, not invulnerability.

BASIS combines deterministic execution, math constraints, explicit stop logic, state machine risk controls, and internationally certified security and service management practices to keep failure modes bounded and observable.

---

Next: read Audits & Responsible Disclosure.