Skip to main content

​
How are my assets custodied?

Roxom custodies your assets using multi-party computation (MPC), an institutional-grade architecture where your private key never exists in full, anywhere. Instead of a single key, your key is split into 3 cryptographic shares distributed across isolated environments. When a transaction needs to be signed, the shares collaborate mathematically to produce a valid signature without ever reconstructing the original key. Not even for an instant. Roxom runs this on Fireblocks infrastructure.
  • 0 single points of failure: no single key can be stolen, copied, or lost
  • Under 1 second signing latency: institutional-grade security with hot-wallet speed
  • Policy engine: every withdrawal goes through Fireblocks’ Policy Engine, which enforces authorization rules before anything is signed
Even if one environment were compromised, funds could not be moved unilaterally. No employee at Roxom, regardless of privileges, can move funds alone.
Fireblocks holds SOC 2, ISO 27001, 27017, 27018, and CCSS certifications, runs a public bug bounty program, and maintains continuous third-party audits.

​
How are transactions screened?

Roxom screens every deposit and withdrawal in real time before it’s processed, checking transactions and wallet addresses against risk indicators including sanctions exposure, darknet activity, stolen funds, and other high-risk behaviors. This screening runs on TRM Labs, which works with over 300 organizations globally and is behind Chainabuse, the largest global database of crypto scam reports, which Roxom contributes to as part of our anti-fraud commitment.

​
Are my funds mixed with Roxom’s?

No. Roxom holds client funds in accounts strictly separate from the company’s operating funds. Your assets cannot be used for Roxom’s operational purposes under any circumstances, not for investments, not for liquidity management, not for anything. Roxom does not rehypothecate, reuse, lend, or pledge client assets. Roxom keeps individualized records per client with daily reconciliation, so your balance is always identifiable and attributable to you at the custodial level. In the event of financial difficulties affecting Roxom, your funds remain identifiable as yours and sit outside the reach of the company’s creditors. This is a regulatory requirement across the jurisdictions where Roxom operates.

​
What happens to my funds if Roxom faces financial difficulties?

Because client funds are held in segregated accounts, they are legally separate from Roxom’s corporate assets. In the event of insolvency or operational discontinuity:
  • Your funds do not become part of Roxom’s estate and are not available to creditors
  • Segregation is enforced at the custodial level through Fireblocks, meaning assets are identifiable and attributable to individual clients
  • Roxom operates under regulatory frameworks in El Salvador and the Seychelles that mandate client fund protection
The specific recovery process depends on the applicable jurisdiction and regulatory authority overseeing the wind-down. In all cases, the segregation structure is designed to ensure your assets remain identifiable and recoverable.

​
Does Roxom carry insurance on custodied assets?

Assets held in Roxom’s custody are covered by insurance maintained by Fireblocks, Roxom’s custody infrastructure provider. The policy covers losses from theft, including employee collusion, third-party hacks, and key compromise events. Beyond that coverage, Roxom’s MPC architecture and policy engine are designed to minimize the risk surface: no single party can move funds unilaterally, and all withdrawals pass through multi-layer authorization.

​
Is Roxom centralized or DeFi?

Roxom is a regulated, custodial platform, not a DeFi protocol. A licensed entity is accountable for safeguarding your assets, under regulatory oversight and AML/CFT obligations. At the same time, the custody architecture takes the strongest property of decentralized systems: with MPC threshold signing and policy-enforced withdrawals, no single party can move your funds. The result is regulatory accountability without the single-point-of-failure risk of a traditional centralized exchange.

​
Does Roxom share my data with third parties?

Roxom does not voluntarily disclose user information to third parties. Disclosure is only made where required by a valid legal order or where permitted under applicable AML/CFT regulation in El Salvador or the Seychelles.

​
Where is Roxom regulated?

Roxom operates through regulated entities in two jurisdictions:
  • El Salvador: Roxom Markets S.A. de C.V. is authorized by the Government of El Salvador as a Bitcoin Service Provider (Custodian, Digital Exchange, Digital Wallet, and Payment Processor) and is registered with the National Digital Assets Commission (CNAD) as a Digital Asset Service Provider
  • Seychelles: Roxom operates under applicable AML/CFT frameworks
Both jurisdictions require client fund segregation, AML/CFT compliance, and transaction monitoring, all of which are enforced in Roxom’s operations.

​
Common questions

Secure your registered email. Since Roxom uses passkey and OTP-based authentication, your email is the most critical external dependency. Use a strong, unique password and enable 2FA. See our full guide on how to secure your account.
It’s better than nothing, but it has a known weakness. Use an authenticator app like Google Authenticator or Authy instead. It’s significantly more secure and takes two minutes to set up.
Yes. You can report a transaction, wallet address, or behavior you consider suspicious. You can also report phishing attempts, unauthorized account activity, or any communication that impersonates Roxom. Reports can be submitted anonymously.
You need at least one strong security method, Passkey or Authenticator App: in addition to email OTP. If you remove a security method, withdrawals are paused for 24 hours as a safety precaution. See full details in security settings for withdrawals.
Yes. Fireblocks maintains insurance coverage for digital assets held in its vaults, covering losses from theft including employee collusion, third-party hacks, and key compromise events. This is in addition to the MPC architecture that prevents any single party from moving funds.
Roxom does not currently publish public Proof of Reserves attestations. Instead, your assets are protected by structural safeguards: segregation audited by El Salvador’s National Digital Assets Commission (CNAD), the Fireblocks MPC architecture, and continuous transaction monitoring. A public proof-of-reserves mechanism is on our roadmap. For specific questions about fund verification, contact help@roxom.com.
Roxom does not voluntarily disclose user information to third parties. Disclosure is only made where required by a valid legal order or where permitted under applicable AML/CFT regulation in El Salvador or the Seychelles.

Report suspicious activity

Report fraud or submit a law enforcement request.

My account was compromised

Steps to take if you suspect unauthorized access.

Security settings for withdrawals

What you need to enable crypto withdrawals.

How to secure your account

Set up passkey and authenticator app.
Last modified on June 15, 2026