Security review for a regulated digital asset platform starts with four questions: who authenticates, where key material lives, who may do what, and how the platform deploys. SettleMint’s DALP 3.0 answers each question with controls documented in product language and enforced in the API layer.
Security, Risk and Internal Audit want evidence they can follow, allowing the review team to verify behavior, check each rule and confirm that control sits in the platform itself. Authentication, secrets handling, role separation and deployment controls are stated in product documentation and applied before handlers run.
A platform that moves regulated assets earns production trust when the review pack and the runtime path match. DALP 3.0 keeps security work on those four production questions so Security, Risk and Internal Audit can walk the same path the platform enforces.
Authentication has two layers Security teams should assess separately.
The outer layer decides whether the caller is authenticated. Identity resolves from an interactive session cookie or an API key. API keys issued for read-only work stay in that scope. Endpoints that require interactive authentication accept the interactive path. Middleware checks the resolved principal against the declared endpoint policy before any handler runs.
The inner layer decides whether that principal may perform the requested operation. Every sensitive endpoint carries a gate that fires before business logic. A role mismatch returns a structured forbidden response. The gate is required for those routes.
High-impact work completes only after a step-up check. The principal re-authenticates within a freshness window of 15 minutes. Session age and role are independent checks; both must pass. Structured errors name which gate fired, so automated controls receive a clear signal for the next step.
Wallet operations include multi-factor authentication on the wallet-verification path through an OIDC-backed MFA flow. Proof of identity beyond the session credential resolves before the on-chain operation proceeds.
Every key and credential the platform uses, including custody API keys, paymaster credentials and signer material, has documented scope, permitted operations and a stated limit. The admin operating model names each control so operators and Internal Audit can verify it from product documentation.
Secrets resolve from a managed backend through request middleware: a cloud key management service, a self-hosted vault or a local provider in non-production. The loader initializes on first access, so a missing or misconfigured backend surfaces immediately under that first request. Raw values stay outside environment variables, outside deployment persistence and outside log output.
Scope is enforced before outbound calls. Paymaster keys stay on paymaster work; custody keys stay on custody work. Rotation stays operational: update the value in the secrets manager, restart the service, and the new value resolves while the deployment artifact stays as is.
The role model has two planes Security and Risk should examine side by side.
Platform administration covers user management, role assignment, integration configuration and system settings. Asset, transfer and compliance rights sit on a separate plane. On that second plane, roles such as supply management, token management, compliance management, identity management, custody, funds management, auditing and governance resolve per executor wallet against the access control of the instrument in use. Holding a role on one instrument keeps that grant on that instrument. Compliance-manager and supply-manager remain independent grants.
Permission definitions live in one contract package consumed by middleware and routes, so a role change propagates consistently. Signer access stays scoped to the on-chain operations each signer may perform. Paymaster and account-abstraction roles are separated per sponsored flow.
Four domains are mutually exclusive by design:
Each principal stays inside a single domain of those four. Separation is enforced in the API layer so domain boundaries remain intact under deployment configuration.
Production reviews also cover how the platform lands in the customer environment. Each service pod runs under a security context that requires privilege discipline and keeps only the capabilities required for operation. Network policy templates set ingress and egress to declared selectors so service traffic stays on the intended paths. Policies are recommended for production and ship ready for clusters that enforce them.
Image pull goes through a single global registry override. One Helm setting redirects first-party images to an internal mirror for private-registry or air-gapped installs, with the chart tree kept whole. Ingress can sit behind a source CIDR allowlist. Durable workflow snapshot-store credentials read from the secrets manager in the same control model as other secrets.
What DALP runs versus what the institution self-hosts is documented, including Helm composition and RPC routing, so a deployment review can work from product documentation and named property paths ready for Security and infrastructure teams.
When a regulated digital asset program runs well, those security controls are ready for Security, Risk and Internal Audit as issued assets, transfers and settlements expand. Authentication gates are visible. Secrets have named homes and limits. Role domains keep platform administration, asset operations, compliance operations and signer access on clear paths. Deployment can follow internal registry and network rules the institution already requires.
Changes in this area are additive enforcement. Existing sessions, keys and role assignments carry forward. The review pack gains clearer gates on operations that now run under the documented control set.
For operating detail, see the admin operating model and the DALP 3.0 security documentation. Related reading in this series: custody and signing, v2 API and operating surfaces, and platform status monitoring. Start from the DALP platform overview for release context.
Want to discuss how DALP 3.0 meets your security and deployment review?
Book a call with our team ↗
SettleMint, headquartered in Leuven, Belgium, with offices in UAE, Singapore and Japan is the company behind DALP, the entirely composable Digital Asset Lifecycle Platform. DALP enables financial institutions, market infrastructure operators, and governments to build, deploy, and manage digital assets and blockchain applications at scale.