> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cargotrading.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Standards at Cargo Finance

> The layers that protect every Cargo vault share: physical custody, legal title, on-chain permissions, key management, AML controls and incident response.

A vault share is only as safe as the weakest link between the warehouse and the wallet. Cargo secures each link separately, in every vault.

## The Security Stack

| Layer | Control |
| :- | :- |
| Goods | Independent collateral manager with sole release authority; goods leave only against payment |
| Verification | An independent inspector weighs and grades every lot; discrepancies above 0.5% suspend the lot |
| Title | Bankruptcy-remote Vault SPV owns every lot |
| Security | One registered pledge over the goods, held by a security agent (a pledge with dispossession) |
| Loss absorption | 10% subordinated first loss per lot; all-risks insurance |
| Share contract | ERC-3643: transfers only between whitelisted identities; a liquidation can never leave the permissioned perimeter |
| Minting | Shares minted only against a collateral-manager receipt; supply cannot exceed receipted units |
| Administration | Safe multisig with a timelock and an independent co-signer; pause guardian |
| Price | Daily NAV with a hedge-market cross-check, fallback and lower-of oracle for lending |

## Code Review and Testing

Contracts that mint, auction and hold value will be independently audited before mainnet; no audit has been completed yet. Reports will be published on [Audits & Bug Bounty](https://docs.cargotrading.xyz/safety/audits-and-bug-bounty.md).

## Access Controls

* Privileged functions (minting, pausing, parameter changes, identity registry updates) are restricted to named roles.
* The identity registry signer key is held under the Safe policy.
* Parameter and rule changes follow 30 days' notice; only safety pauses are immediate.

## Operational Security and AML

* KYC and KYB through Persona, with sanctions, PEP and adverse-media screening.
* Wallet screening on registration, on every new order and every six months; wallets exposed to sanctioned addresses are frozen pending review.
* Source of funds checked above \$100,000.
* Identity data stays with the verification provider and the compliance team. Only a participant ID and wallet status go on-chain.
* Deposit addresses are confirmed by phone with a named director and a test transfer, never by message.

## Incident Response

**1. Detect**

Automatic triggers: NAV oracle failure, a collateral-manager discrepancy above 0.5%, a sanctions hit or a chain incident.

**2. Contain**

The affected batch, creations or redemptions are suspended. A suspect lot is frozen until topped up or met from subordinated shares, with an independent recount.

**3. Communicate**

The reason is published on the official channels and sent to eligible investors.

> [!WARNING]
>
> Paper records (receipts, the pledge register and signed agreements) are the fallback if a chain or key fails. No set of controls removes all risk.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.