HT-00 Security and assurance file, last reviewed
Crypto custody security at Hex Trust: SOC 2 reports, FIPS 140-3 Level 3 HSMs and insurance terms
Hex Trust keeps client keys in hardware security modules validated to FIPS 140-3 Level 3, completed a SOC 2 Type II examination in December 2023 (AssuranceLab) and SOC 1 Type I and II in February 2023 (Deloitte), is listed on the CSA STAR registry, and publishes an insurance limit of US$25,000,000 across all clients.
Risk warning. Not financial advice. Crypto is highly volatile and may drop in value significantly. You may lose the amounts you invest and your investments do not benefit from any form of financial protection.
File index
Assurance reports and certifications
The live trust centre lists SOC 1 and SOC 2 examinations and one cloud security certification. Each row gives the issuer and the completion date, because a report is evidence only when you know who signed it and when.
| Report | Type | Auditor or issuer | Completed | How to verify |
|---|---|---|---|---|
| SOC 2 | Type I | Deloitte | March 2022 | Ask Hex Trust for the report |
| SOC 1 | Type I and Type II | Deloitte | February 2023 | Ask Hex Trust for the report |
| SOC 2 | Type II | AssuranceLab | December 2023 | Ask Hex Trust for the report and the period it covers |
| CSA STAR | Level 2 certification | Cloud Security Alliance programme; auditor not named | December 2023 | CSA STAR registry: Hex Trust |
From the live trust centre, read . CSA registry opened .
A SOC 1 report covers controls that matter to a client's own financial reporting. A SOC 2 report covers controls for security and related criteria. Type I tests the design of the controls at one date; Type II tests whether they worked over a period. The AICPA describes both in its SOC suite of services.
In the STAR programme of the Cloud Security Alliance (CSA), Level 1 is a self-assessment and Level 2 is a certification or third-party attestation. The registry shows Hex Safe listed since 15 February 2022, with CAIQ and Attestation entries, and Hex KYC since 15 March 2023, with a CAIQ entry. Hex Trust is a corporate member of the CSA.
The latest dated report on the trust centre is from December 2023. The pages read for this file give no report period, no later report and no bridge letter.
Ask for the most recent SOC 2 Type II report, the period it covers, the auditor's opinion with any exceptions, and a bridge letter that runs to the present.
Key management architecture
The published design rests on hardware security modules (HSMs): devices that generate, keep and use private keys without releasing them to ordinary servers. The figure shows the control flow of a transfer and the controls that the live site names around the key.
HSMs validated to FIPS 140-3 Level 3
The trust centre says that the HSMs are validated to FIPS 140-3 Level 3 and names the vendor, Securosys Primus. FIPS 140-3 is the United States standard for cryptographic modules: NIST published it on 22 March 2019 to supersede FIPS 140-2. It defines four levels of security, each stricter than the one before, so Level 3 is the third of four. A validation belongs to one module model and firmware version. Ask for the certificate number and look it up in the NIST list of validated modules.
Air-gapped Safe Plus and Safe Vaults
The storage arrangement page names two storage options, Safe Plus and Safe Vaults, and says that both operate air-gapped: the signing equipment has no network connection. Hex Safe states a 2-hour service level for withdrawals from cold wallets and near-instant withdrawals from warm wallets. The page does not say how a transaction reaches an air-gapped module or how many people must be present.
Key generation and backup
Keys are generated with a true random generator and are always wrapped, that is, kept encrypted under another key. Encrypted keys are stored in multiple vaults in different locations. Ask how many vaults there are, in which countries, who can open one, and when a recovery was last tested.
Network isolation with data diodes
The custody page lists a cross-domain solution built on data diodes. A data diode is a link that passes data in one direction only, used where a protected network must exchange data with a less protected one. The page does not say which networks the diodes separate. The trust centre also describes a custody framework built on ten principles, among them asset segregation, flexible approvals and hot, warm and cold wallet options.
How this model differs from the alternatives is explained in HSM, MPC and multisig custody compared. How it is sold is described on the institutional crypto custody service page.
Infrastructure and data centres
Applications are hosted primarily on Amazon Web Services and Google Cloud Platform, according to the trust centre. The same page lists four certifications held by the data centres.
- ISO 9001:2015
- Quality management
- ISO 27001:2013
- Information security management
- ISO 22301:2019
- Business continuity management
- ANSI/TIA-942-A
- Data-centre infrastructure
Issuer: not named. Dates: not published. Source: live trust centre, read 6 October 2026.
These certificates belong to the data centres. The live site does not show an ISO 27001 certificate issued to a Hex Trust company. If your policy requires one from the custodian itself, ask whether it exists.
Testing and monitoring
- Penetration testing Ongoing, by Deloitte, which the trust centre describes as CREST-accredited. How often tests run and when the last one finished are not published.
- Transaction monitoring Chainalysis KYT screens transactions and Chainalysis Reactor supports investigations; the trust centre places both inside the compliance framework. The wallets page says that Travel Rule and KYT screening come with custody wallets at no extra cost: see what is included in pricing.
- Bug bounty No bug bounty or vulnerability disclosure programme was found on the live site. Security reports go to [email protected].
Insurance coverage
Limit
The live insurance framework states a “maximum coverage of US$25,000,000 across all clients”. That is one limit shared by every client, not an amount per client.
- Limit, all clients together
- US$25,000,000
- Insurer
- Not published
- Policy period
- Not published
Source: live insurance framework, read 6 October 2026. The live custody page shows a limit of $25M+ in its text and $50M+ in its structured data.
What is covered
- Dishonest or fraudulent acts or omissions of the custodian.
- Physical loss of or damage to private keys from natural disaster or violent acts.
- Exclusions and the deductible.
- How the limit is shared when several clients claim.
- Whether any other loss is covered.
The framework names two insured events and nothing else. Market losses are not among them. Ask for the insurance certificate.
How a claim works
Report the incident
Incidents are to be reported to [email protected] within 24 hours.
Claim approval
The framework does not say who assesses a claim or how long approval takes.
Payment
The insurer pays within 30 business days of claim approval.
Segregation and insolvency
The custody page says that client assets are segregated in law and in technology, through on-chain account structures, and describes the arrangement as an “Insolvency-Remote Legal Structure”. Neither statement comes with its legal basis. The custody terms or trust deed, the governing law and a legal opinion are not published.
Segregation lowers the risk of loss. It does not remove it. The risk warning that MAS requires on the live Singapore page says that a trust account or segregated account kept by Hex Technologies Pte. Ltd. “may not fully protect your money or DPTs from loss” if that company's business fails.
Source: live Singapore page, read 6 October 2026. DPT stands for digital payment token.
The rules that protect your assets depend on the company that holds them: see the legal entities and governance file and the licences and register entries. Assets that you stake remain in custody but add risks of their own, set out under staking from custody and its risks. The general risks of digital asset services are in the risk disclosure.
Incidents and reporting
Report a suspected phishing message, a fake site or a security incident to [email protected]. The security notice lists five official addresses. Treat any other domain that uses the Hex Trust name as unverified.
- Incident log
- Not published
- Post-incident reports
- Not published
The live site carries no incident log and no post-incident reports. Ask for a written statement of security incidents since 2018 and for the incident response policy.
Request the due-diligence pack
A security review rests on documents, not on web pages. These are the items a procurement or risk team should ask for. The live site does not say which of them Hex Trust releases, or on what terms.
- SOC reports The latest SOC 1 and SOC 2 Type II reports, with the period covered and a bridge letter.
- Insurance certificate Insurer, limit, policy period, insured events and exclusions.
- Penetration-test summary Tester, date, scope and open findings.
- HSM certificate The FIPS 140-3 certificate number for the module model in use.
- Policy list Information security, key management, incident response and business continuity.
The custodian due diligence checklist turns this list into questions by review area, and more guides sit under security and custody insights. To start, request the due-diligence pack from institutional sales.
Prepared by the Hex Trust Research Team and reviewed by the Head of Compliance. For information only; not investment advice.
Start your security review
Tell institutional sales which entity would hold your assets and which documents your policy requires. Ask for report periods and certificate numbers, not summaries.
Risk warning. Not financial advice. Crypto is highly volatile and may drop in value significantly. You may lose the amounts you invest and your investments do not benefit from any form of financial protection.