Security & Trust
How we hold your assets, control agent payments, and document what is — and is not — production-ready today.
How your assets are held
User custodial wallets are operated under a single HD (hierarchical deterministic) wallet on CAI-controlled infrastructure. Private keys are never stored in our database. Signing is performed by our Wallet Gateway service on dedicated origin servers, using BIP39 hierarchical derivation — each user account maps to an isolated derivation index. Our database stores only public addresses and derivation indices, so a database compromise alone cannot move funds.
Payment controls
Every high-risk operation requires explicit user confirmation. Agents cannot move funds silently: x402 payment flows carry requires_user_confirm, and payment mandates let you pre-authorize bounded scopes — anything outside the mandate is confirmed per transaction.
Credential vault vs. wallet keys
The CAI vault stores third-party site and platform credentials (login tokens, API keys) in encrypted form. It does not store blockchain private keys. Wallet keys live only in the Wallet Gateway signing path.
Honest capability disclosure
We publish a clear list of what works today and what is still in progress — see our capability status page. We would rather tell you upfront than have you hit a surprise gap.
What we don't claim
We do not use cloud HSMs. We do not claim regulatory licenses we don't hold. We do not offer insurance on custodied assets. Our current security posture is documented above — no more, no less. As we add infrastructure (hardware key management, third-party audits, insurance), this page will be updated.
Responsible disclosure
Found a security issue? Email [email protected]. We aim to acknowledge reports within 72 hours.
Company
CAI.com is operated by Crypto AI Labs Limited (加密智能實驗室有限公司), incorporated in Hong Kong and backed by CAI Corp (SEHK: 0080) as a strategic investor. Your assets are custodied only by Crypto AI Labs Limited — not by shareholders or affiliates.
Team
We are a small Hong Kong team building agent operating accounts — @cai.com identity, custodial wallets, and payments you stay in control of.