Private by construction
The digital ledger exposes no public interface. The Cosmos Tokenization Suite (CTS) adapter reaches it over EVM JSON-RPC from inside the deployment, and only the IBC relaying components are externally reachable. This means the attack surface is limited to the components whose job requires them to be reachable. See Digital Ledger Support.The operator key model
The bank holds a privileged operator key. It mints, burns, and transfers deposit tokens and sends IBC messages. End users do not hold their own keys for deposit tokens: a customer’s tokenized balance is controlled by the bank, in the same way their demand deposit is. Production deployments should hold the operator key in an institutional custody arrangement or an HSM or threshold-signing setup, so that no single machine or person can act alone. See Key Security and Governance for how custody arrangements and signing policy apply.Account blocking on the ledger
The digital ledger enforces a per-account block control. An address can be marked blocked, after which all deposit token transfers to and from it, including mint and burn, revert until it is unblocked. Blocking is enforced at the ledger: the transfer never executes, so a freeze takes effect without depending on every upstream system honouring it. Screening, KYC, and monitoring remain in the bank’s existing systems, reached over the policy and logs interface.Observability
CTS emits logs, metrics, and traces over OpenTelemetry. A bank routes them into whatever observability stack it already runs, whether Datadog, Splunk, or Grafana and Loki. The reference deployment ships a default stack, but nothing depends on it: any OpenTelemetry-compatible backend works. Tokenized infrastructure joins the bank’s existing operational tooling.Cross-chain trust
Where a connection uses attestor-based verification, the attestor set is the trust anchor. Production deployments should use a multiple-signer or threshold attestation scheme rather than a single attestor. See Verification Models.The full KYC and AML integration scope, and the hardening guide for a production
deployment, still need to be documented. Confirm the current scope for your
deployment with us.