Security & Audits
Security is foundational to human.tech, not an afterthought. The core systems are independently audited and built so that sensitive data is never held in the clear by any single party.
Independent audits
Wallet-as-a-Protocol (WaaP) has completed multiple independent code audits, covering the Two-Party Computation signing, policy engine, SDK, and CLI:
- Cure53
- Hexens
- Least Authority
- Halborn
WaaP has also undergone additional security engagements with Anderson Software and Distrust.
Shield, the Ethereum-to-Aztec bridge, is built from independently audited components, each scoped to the firm that reviewed it:
- Bridge contracts (Ethereum L1 and Aztec L2 Noir): audited by Nethermind Security (report NM-0756, May 2026).
- Clean Hands ZK circuits: audited by Hexens (2024).
- Human Network threshold cryptography: audited by Halborn (2024).
Shield is live on Aztec v5 mainnet (as of 2026-07-21). Aztec remains an alpha network with ongoing audits and an active bug bounty. See the Shield page for current network status.
Audit reports are available on request. Contact security@holonym.id.
Privacy by construction
- No PII on-chain. Personal data is never written to a blockchain in the clear. It is hashed or encrypted to a threshold network. See Zero-Knowledge Identity.
- No single point of compromise. Keys are split with Two-Party Computation, and identity data is encrypted to a threshold network where a quorum is required to act.
- Fail closed. Compliance checks fail closed. If sanctions screening cannot be completed, no attestation is issued and the action is blocked.
- Self-custody. Users hold their own keys, with no custodian able to move funds. See Self-Custody.
Report a vulnerability
To report a security issue, contact security@holonym.id.