Crypto asset security and card data security, from someone who's done both.
Two areas that come up often enough to call out on their own: protecting digital assets for holders and funds, and getting payment companies, crypto rails included, ready for PCI DSS.
CISSP · 10+ years in security · ISO 27001 · SOC 2 · GDPR · DORA · PCI DSS
Crypto asset security
For individuals, family offices, funds, and companies holding meaningful crypto value who want an outside, security-first review of how those assets are actually protected.
What we look at
- Wallet and custody architecture. Hot versus cold, multisig setup, who holds which keys, and what a single point of failure would look like in your specific setup.
- Key management and recovery. How keys are generated, stored, backed up, and recovered if a device, a person, or a location is lost.
- Access and approval controls. Who can initiate a transfer, who has to approve it, and whether that matches how much is actually at stake.
- Counterparty and custodian risk. What happens to your assets if an exchange, custodian, or bridge you rely on fails or is compromised.
- Targeted attacks. Crypto holders are a specific, well-understood target. We test and harden against the attacks that actually get used against people in your position.
- Incident response. A plan for a compromised wallet or key, written before you need it, so the first hour isn't spent figuring out what to do.
What this isn't
We review and advise. We never take custody, hold your keys, or execute transactions. You keep full control throughout.
We don't audit smart contract code line by line. That's a specialised discipline, and if you need it, we'll point you to someone who does it well.
And we don't give investment advice. Nothing here is about what to buy, hold, or sell.
Scoped and quoted the same way as everything else: Talk to a CISO for a focused review, or CISO as a Service if you want ongoing coverage.
Card data and payment security
For companies that store, process, or transmit cardholder data, including crypto exchanges and wallets that take card top-ups, and payment companies bridging fiat and crypto rails.
What we do
- Scoping. Working out what's actually in your cardholder data environment, often smaller, or larger, than people assume.
- Gap analysis against the current PCI DSS standard, in plain language, ranked by what actually reduces risk first.
- Remediation support. Fixing the gaps, not just listing them: network segmentation, encryption, access control, logging, vendor management.
- Evidence and documentation ready to hand to an assessor, so the formal assessment goes smoothly instead of starting from zero.
- The formal assessment. The Report on Compliance (ROC) or Attestation of Compliance (AOC) is completed by an accredited QSA. We do the readiness work so that assessment is fast and uneventful, and we'll help you choose a QSA.
Scoped and quoted the same way as everything else: Talk to a CISO for a focused assessment, or CISO as a Service if you want it owned on an ongoing basis.
If you're building AI agents that touch funds or crypto assets directly, also see Agent Security Reviews →
Questions
Do you manage or custody my crypto for me?
No. We review and advise. We never take custody, hold keys, or execute transactions. You keep full control at every step.
Is this investment advice?
No. We assess and improve your security. We don't advise on what to buy, hold, or sell.
Do you audit smart contracts?
Not code-level smart contract audits. That's a specialised discipline, and we'll refer you to someone who does it well. We assess the operational security around how your crypto is stored, accessed, and moved.
What counts as "in scope" for PCI DSS?
Any system that stores, processes, or transmits cardholder data, plus anything connected closely enough to affect its security. We help you find that boundary. Most companies think it's bigger, or smaller, than it actually is.
Can you get us PCI DSS certified?
We do the readiness work: gap analysis, remediation, evidence. The formal assessment is completed by an accredited QSA, and we'll help you choose one.
Let's talk
Tell us what you're holding, building, or processing, and what's driving the need. Thirty minutes, no pitch.
We reply to every enquiry within one business day.