Security Policy.

Overview

Security is not an afterthought at Global Crest Limited — it is the foundation on which the entire Platform is built. We employ a multi-layered security architecture that protects your assets, personal data, and account at every level.

This Security Policy describes the technical and organizational measures we have implemented to protect our Platform and your investments.

Asset Security

Protecting your cryptocurrency assets is our highest priority. We employ an institutional-grade custody model:

Cold Storage

95% of all client assets are held in air-gapped cold storage wallets that are completely disconnected from the internet. These wallets are stored in geographically distributed, physically secured vaults with multi-signature authorization requirements.

Hot Wallet Security

The remaining 5% held in hot wallets for operational liquidity is protected by:

• Multi-signature authorization requiring 3-of-5 key holders to approve transactions
• Hardware Security Modules (HSMs) for key management
• Strict withdrawal limits and anomaly detection
• Real-time transaction monitoring

Account Security

• Two-Factor Authentication (2FA) — available and strongly recommended for all accounts
• Session management — automatic session expiry after inactivity; concurrent session detection
• Login anomaly detection — alerts for logins from new devices or unusual locations
• Password security — passwords are hashed using bcrypt with per-user salts; we never store plaintext passwords
• Withdrawal confirmations — all withdrawals require email confirmation
• Account lockout — accounts are temporarily locked after repeated failed login attempts

Data Security

Encryption

• In transit: All data is transmitted over TLS 1.3 with HSTS enforcement
• At rest: All database data is encrypted using AES-256
• Backups: All backups are encrypted before storage and stored separately from primary data

Access Controls

• Role-based access control (RBAC) limits internal access to customer data
• All admin access requires VPN and hardware security keys
• Access logs are maintained and reviewed regularly
• Principle of least privilege applied across all systems

Infrastructure Security

• Hosted on ISO 27001-certified cloud infrastructure
• Web Application Firewall (WAF) protecting against OWASP Top 10 vulnerabilities
• DDoS protection with automatic traffic scrubbing
• Network segmentation isolating critical systems
• Regular penetration testing by certified third-party security firms
• Intrusion Detection System (IDS) monitoring all network traffic

24/7 Monitoring

Our security operations run around the clock. We monitor for:

• Unusual login patterns or account access
• Abnormal withdrawal requests or large transactions
• Platform availability and performance anomalies
• Known malware signatures and attack patterns
• API abuse and rate-limit violations

Automated alerts escalate to our on-call security team immediately when thresholds are breached.

Incident Response

In the event of a security incident, we follow a structured response plan:

• Detect — automated monitoring identifies the incident
• Contain — affected systems are isolated within minutes
• Assess — scope and impact are evaluated by our security team
• Notify — affected users are notified within 72 hours as required by GDPR
• Remediate — root cause is identified and fixed
• Review — post-incident analysis to prevent recurrence

Your Role in Security

Security is a shared responsibility. Here's how you can protect your account:

• Enable Two-Factor Authentication (2FA) on your account
• Use a strong, unique password not used on other sites
• Never share your password or 2FA codes with anyone — including Global Crest Limited staff
• Verify you are on the correct URL before logging in
• Be cautious of phishing emails claiming to be from Global Crest Limited
• Log out of your account when using shared devices
• Notify us immediately if you suspect unauthorized account access

Responsible Vulnerability Disclosure

We take security research seriously and welcome responsible disclosure of vulnerabilities in our Platform. If you discover a potential security issue:

• Email us at security@global-crest-limited.pro with details of the vulnerability
• Do not exploit the vulnerability or access user data
• Give us reasonable time to investigate and fix the issue before public disclosure
• We will acknowledge your report within 48 hours

We appreciate the security research community's efforts and will publicly credit researchers who responsibly disclose valid vulnerabilities (with their consent).

Contact

For security concerns or to report a vulnerability:

• Security team: info@global-crest-limited.pro
• General support: info@global-crest-limited.pro
• Address: 3, Waterhouse Square, 138–142 Holborn, London EC1N 2SW, UK