Skip to main content

Security & Compliance

List any security audits, certifications, or penetration tests that have been performed, including participation in bug bounty programs.​

The platform is regularly tested for security. For details on audits, certifications, penetration tests or bug bounty programs, contact the HollaEx team.

Does the platform provide security alerts for suspicious activities?​

Yes. The platform includes multiple layers of activity monitoring:

  • Login confirmation: users confirm logins from a new device or location with an emailed code, helping prevent account takeovers.

→ Under Attack?

  • Email audit trail: an auditor's email can be configured to receive copies of all important emails sent by the exchange (e.g. login alerts, password changes, bank verification).

→ Email Customization & Audit

Additional real-time alerting can be set up via API integrations with third-party monitoring tools.

How does the platform handle Anti-Money Laundering (AML) regulations and compliance with restricted jurisdictions?​

AML compliance can be handled in several ways:

  • Scorechain plugin: automated crypto AML and risk-scoring that screens on-hold deposits and withdrawals against blockchain analytics. Transactions are scored by severity and automatically blocked or released based on your configured threshold (mixers, sanctioned entities, scams, etc.).

→ Scorechain - Crypto Risk Screening

  • Built-in KYC/AML: HollaEx offers a built-in KYC/AML system through its partnership with iDenfy. You can also opt in to another provider, such as Sumsub, Persona or Shufti Pro, instead.

→ KYC & AML

  • Restricted jurisdictions: block specific countries with Geofencing in Operator Controls → Exchange → Configuration → Security.

→ Operator Controls: Configuration

  • Email audit trail: an auditor's email can be configured to receive copies of all important exchange emails for compliance monitoring.

→ Email Customization & Audit

Does your platform support mandatory 2FA enforcement and strong 2FA methods such as WebAuthn tokens, Passkeys, and TouchID?​

2FA (one-time codes) is supported, and you can require it for withdrawals with Force 2FA on Withdrawal in Operator Controls → Exchange → Configuration → Security. For other 2FA requirements or methods such as passkeys, contact the HollaEx team.

→ Operator Controls: Configuration

Does the platform support flexible login options, such as Google, Apple, Microsoft, and other third-party login providers?​

Google sign-in is supported: users can sign up and log in with their Google account. To turn it on, open Operator Controls → Exchange → Configuration → Security, find Google OAuth and enter the Client ID from Google Cloud Console.

Other providers such as Apple or Microsoft aren't supported by default. Contact the HollaEx team about custom development.

Does the platform include functionality to enable or disable key features (e.g., withdrawals, user logins) in case of a security breach?​

Yes. Several tools are available for responding to security incidents:

  • Cloudflare Turnstile: can be enabled immediately to block brute-force login and password reset attacks.

→ Under Attack?

  • Auto deposit/withdrawal hold: turn off Auto Deposit or Auto Withdrawal in Operator Controls → Exchange → Configuration → Security so deposits or withdrawals need manual approval.

  • Feature toggles: turn off individual exchange features (Pro Trade, Quick Trade, fiat controls and so on) in Operator Controls → Exchange → Configuration → Features.

  • Country blocking: block specific jurisdictions with Geofencing in Operator Controls → Exchange → Configuration → Security.

→ Operator Controls: Configuration

  • Session revocation: admins can view all active user sessions and end them.

→ Operator Controls: Sessions & Logins

  • Account freezing: admins can freeze individual user accounts at any time.

→ Operator Controls: Users

Provide an overview of the security architecture and measures in place.​

HollaEx's security measures include:

  • Attack mitigation: Cloudflare Turnstile CAPTCHA against brute-force attacks, login confirmation for new devices, IP blocking and account freezing.

→ Under Attack?

  • Access controls: role-based operator permissions, with default roles and customizable permissions, plus an admin IP allowlist and admin API endpoints that are off by default.

→ Operator Controls: Access Control

  • Session management: full session visibility with IP, device, and country tracking; admin can revoke any active session.

→ Operator Controls: Sessions & Logins

  • Admin logs: comprehensive audit log of all operator actions on the exchange.

→ Operator Controls: Admin Logs

  • Email audit trail: all important emails and sensitive actions copied to a designated auditor address.

→ Email Customization & Audit

  • Uptime monitoring: status page for exchange availability and maintenance windows.

→ Status Page

  • KYC/AML: built-in system through HollaEx's partnership with iDenfy, or another provider you opt in to.

→ KYC & AML

  • AML/risk screening: Scorechain plugin for automated crypto risk screening; deposits and withdrawals automatically blocked or released based on severity threshold.

→ Scorechain - Crypto Risk Screening

For detailed security architecture documentation, contact the HollaEx team.