# Compliance and security

Source: https://docs.settlemint.com/docs/compliance-security
Choose the right DALP compliance and security guide for public-chain privacy,
pre-launch review, source verification, the layered security model, and the
per-asset compliance modules that enforce regulated operations.




Use this section to pick the right DALP compliance or security page before a regulated programme goes live. Start with privacy when you need to know what becomes visible on EVM networks. Start with security when you need the control model. Start with compliance modules when you need per-asset transfer rules. Start with source verification when you need deployment and audit evidence.

This is a review hub, not a legal opinion. DALP documents the platform controls and evidence surfaces. Your organisation still owns policy choices, jurisdictional approval, custody arrangements, recovery targets, and operating procedures.

For SettleMint-hosted or managed deployments, procurement and security reviewers can also use the [SettleMint Trust Center](https://trust.settlemint.com/) for security questionnaires, compliance frameworks, and governance policies. Operators can check the [SettleMint status page](https://status.settlemint.com/) for published platform availability and incident history.

<Mermaid
  chart="`
flowchart TD
Reader[&#x22;Compliance, security, or audit reviewer&#x22;] --> Privacy[&#x22;Public-chain privacy&#x22;]
Reader --> Security[&#x22;Layered security controls&#x22;]
Reader --> Modules[&#x22;Per-asset compliance modules&#x22;]
Reader --> Evidence[&#x22;Deployment evidence and audit trails&#x22;]
Privacy --> Visibility[&#x22;Visibility, ordering, patterns, pre-launch review&#x22;]
Security --> Controls[&#x22;Identity, access, wallet verification, custody split&#x22;]
Modules --> Rules[&#x22;Identity, geography, supply, approvals, collateral, timelock&#x22;]
Evidence --> Sources[&#x22;Source verification, deployment, indexed events&#x22;]
`"
/>

The pages below cover documented platform behaviour. They do not commit to regulator-specific approval, custody terms, SLA terms, or non-EVM deployment support. Treat those as organisation-specific controls unless a detail page states the DALP behaviour explicitly.

## What DALP covers [#what-dalp-covers]

DALP separates compliance and security review into four surfaces: public-chain privacy patterns, the layered security model, EVM compliance modules, and deployment evidence that lets an auditor reproduce what was deployed and what happened after.

| Area           | DALP defines                                                                                         | Your organisation defines                                                                                          |
| -------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| Privacy        | What stays off-chain by default, the public-chain visibility model, and supported routing patterns   | Network selection, RPC and routing decisions, legal review of public disclosure, and pre-launch approval ownership |
| Security       | Identity, authentication, authorization, wallet verification, compliance, custody split, and routing | Operator role assignment, policy approvals, custody arrangements, secret rotation, and incident response           |
| Compliance     | Per-asset compliance modules for identity, geography, supply, approvals, collateral, and timelock    | Module configuration, policy thresholds, jurisdictional approvals, and review evidence                             |
| Audit evidence | Source verification, deployment auditability, indexed events, and operating-record retention model   | Retention policy, regulator-specific reporting, control testing, and escalation procedures                         |
| Exclusions     | Documented platform behaviour and supported review surfaces                                          | Legal opinions, SLA commitments, custody arrangements, and bridge or cross-chain operating decisions               |

## Pick the right path [#pick-the-right-path]

| If you need to...                                  | Start here                                                                                                | Then read                                                                                                                                                                                                                  |
| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Decide if a regulated asset can use a public chain | [Public chain privacy](/docs/compliance-security/privacy/overview)                                        | [Public EVM visibility model](/docs/compliance-security/privacy/public-evm-visibility-model) for the chain-visible data set                                                                                                |
| Inspect what is visible on EVM networks            | [Public EVM visibility model](/docs/compliance-security/privacy/public-evm-visibility-model)              | [Transaction ordering privacy](/docs/compliance-security/privacy/transaction-ordering-privacy) for pre-confirmation exposure                                                                                               |
| Compare privacy architecture patterns              | [Privacy architecture patterns](/docs/compliance-security/privacy/architecture-patterns)                  | [Pre-launch privacy review](/docs/compliance-security/privacy/pre-launch-review) before a regulated asset goes live                                                                                                        |
| Trace deployed contracts and operating evidence    | [Source verification and deployment auditability](/docs/compliance-security/source-verification/overview) | The deployment, bytecode, upgrade, and indexed-event sections inside the same page                                                                                                                                         |
| Review the layered security control model          | [Security overview](/docs/compliance-security/security)                                                   | [Authentication](/docs/compliance-security/security/authentication), [Authorization](/docs/compliance-security/security/authorization), [Wallet verification](/docs/compliance-security/security/wallet-verification)      |
| Inspect identity and compliance evidence           | [Identity and compliance control model](/docs/compliance-security/security/identity-compliance)           | [Compliance and custody split](/docs/compliance-security/security/compliance-custody-boundary)                                                                                                                             |
| Review per-asset compliance modules                | [Asset policy](/docs/compliance-security/compliance/asset-policy)                                         | [Asset policy concept](/docs/architecture/concepts/asset-policy), [compliance modules overview](/docs/compliance-security/compliance), and the identity, country, supply, approvals, collateral, and timelock module pages |
| Review cross-chain and stablecoin trust boundaries | [Bridge and cross-chain security](/docs/compliance-security/security/bridge-cross-chain)                  | [Stablecoin operating responsibilities](/docs/compliance-security/security/stablecoin-architecture-trust-boundaries)                                                                                                       |

## Review model [#review-model]

DALP separates compliance and security review into four surfaces:

* Privacy review answers what becomes visible on EVM networks, when public-chain visibility is acceptable, and which controls belong in the deployment architecture.
* Security review inspects the layered control model: authentication, authorization, wallet verification, identity and compliance enforcement, custody split, and routing decisions.
* Compliance module review inspects the per-asset rules DALP enforces on EVM for identity, geography, supply, approvals, collateral, and holding periods.
* Audit evidence review traces deployed contracts, upgrade history, indexed events, and operating records that document what was deployed and what happened after.

Most regulated programmes go through all four. Use the privacy pages first when the network is undecided, the security pages when reviewing the platform controls, the compliance module pages when configuring per-asset policy, and the source verification page when packaging audit evidence.

## Privacy [#privacy]

<Cards>
  <Card title="Public chain privacy" href="/docs/compliance-security/privacy/overview">
    Decide what DALP keeps off-chain and which controls belong in the deployment architecture.
  </Card>

  <Card title="Public EVM visibility model" href="/docs/compliance-security/privacy/public-evm-visibility-model">
    Map the data that becomes visible on public EVM networks and the evidence that stays off-chain.
  </Card>

  <Card title="Transaction ordering privacy" href="/docs/compliance-security/privacy/transaction-ordering-privacy">
    Review pre-confirmation exposure through RPC, bundlers, builders, sequencers, and validators.
  </Card>

  <Card title="Privacy architecture patterns" href="/docs/compliance-security/privacy/architecture-patterns">
    Compare public eligibility, private evidence, permissioned networks, and metadata-minimisation patterns.
  </Card>

  <Card title="Pre-launch privacy review" href="/docs/compliance-security/privacy/pre-launch-review">
    Run the operator checklist for fields, evidence, routing, and approval owners before launch.
  </Card>
</Cards>

## Source verification and audit evidence [#source-verification-and-audit-evidence]

<Cards>
  <Card title="Source verification and deployment auditability" href="/docs/compliance-security/source-verification/overview">
    Trace deployed EVM contract systems through addresses, bytecode checks, migrations, upgrade evidence, and indexed
    events.
  </Card>
</Cards>

## Security overview [#security-overview]

<Cards>
  <Card title="Security overview" href="/docs/compliance-security/security">
    Inspect the layered control model for identity, access, wallet verification, compliance, and custody.
  </Card>

  <Card title="Authentication" href="/docs/compliance-security/security/authentication">
    Review sessions, 2FA, passkeys, and API key authentication for browser and integration callers.
  </Card>

  <Card title="Authorization" href="/docs/compliance-security/security/authorization">
    Inspect platform RBAC, organisation context, and on-chain roles for governed actions.
  </Card>

  <Card title="Identity and compliance" href="/docs/compliance-security/security/identity-compliance">
    Connect participants, wallets, OnchainID claims, trusted issuers, and module evaluation.
  </Card>

  <Card title="Compliance and custody split" href="/docs/compliance-security/security/compliance-custody-boundary">
    Separate identity and compliance decisions from custody approvals and signing policy.
  </Card>

  <Card title="Mint replay and idempotency" href="/docs/compliance-security/security/replay-idempotency-mint-controls">
    Tie EVM mint retries to one queued transaction while preserving nonce ordering and supply controls.
  </Card>

  <Card title="Vendor governance" href="/docs/compliance-security/security/vendor-governance">
    Split DALP controls from third-party services for outsourcing, DORA, and vendor governance evidence.
  </Card>

  <Card title="Private mempool routing" href="/docs/compliance-security/privacy/private-mempool-routing">
    Route DALP transactions through a private or encrypted mempool service and review what stays operator-owned.
  </Card>

  <Card title="Wallet verification" href="/docs/compliance-security/security/wallet-verification">
    Gate blockchain write operations behind PIN, TOTP, or backup-code verification.
  </Card>

  <Card title="Bridge and cross-chain security" href="/docs/compliance-security/security/bridge-cross-chain">
    Review where DALP controls end and which external-route evidence operators must own.
  </Card>

  <Card title="Stablecoin operating responsibilities" href="/docs/compliance-security/security/stablecoin-architecture-trust-boundaries">
    Map mint, burn, reserve, compliance, governance, and operator-owned responsibilities for stablecoins.
  </Card>
</Cards>

## Compliance modules [#compliance-modules]

<Cards>
  <Card title="Compliance modules overview" href="/docs/compliance-security/compliance">
    See how per-asset compliance modules enforce regulated EVM token operations.
  </Card>

  <Card title="Asset policy" href="/docs/compliance-security/compliance/asset-policy">
    Combine identity, modules, lifecycle hooks, and governance into per-asset policy.
  </Card>

  <Card title="Country" href="/docs/compliance-security/compliance/country">
    Restrict eligibility and operations by jurisdiction.
  </Card>

  <Card title="Identity lists" href="/docs/compliance-security/compliance/identity-lists">
    Allow or block transfer participants using identity lists.
  </Card>

  <Card title="Address block list" href="/docs/compliance-security/compliance/address-block-list">
    Block transfer participants by EVM address.
  </Card>

  <Card title="Identity verification" href="/docs/compliance-security/compliance/identity-verification">
    Require verified identity claims before regulated operations execute.
  </Card>

  <Card title="Policy-based transfer controls" href="/docs/compliance-security/compliance/policy-based-transfer-controls">
    Configure transfer policy expressions on per-asset rules.
  </Card>

  <Card title="Supply and investor limits" href="/docs/compliance-security/compliance/supply-investor-limits">
    Apply supply caps and investor-count limits to an asset.
  </Card>

  <Card title="Transfer approval" href="/docs/compliance-security/compliance/transfer-approval">
    Require pre-transfer approval workflows for governed actions.
  </Card>

  <Card title="Supply cap collateral" href="/docs/compliance-security/compliance/supply-cap-collateral">
    Tie supply caps to collateral attestations for backed assets.
  </Card>

  <Card title="Timelock" href="/docs/compliance-security/compliance/timelock">
    Apply holding-period or vesting controls to regulated assets.
  </Card>
</Cards>