Keeping it safe
Every breakhas a ceiling.
Money is kept in separate places with separate rules, so breaking one open does not open the rest. Whatever is reached is limited, known in advance, and small.
It gets in as far as ring four. Ring five is the ceiling.
- 36separate boxes. Break one, the rest are untouched.
- No single keyKeys exist only as pieces, in separate places.
- A daily capThe most anything can move in one day, set in advance.
01 · How far anything gets
Five rings,
outside in.
Ring 1 is the most exposed and the least valuable. Ring 5 is the ceiling, and it is the hardest thing on the system.
- The surface Pages, app state, live sessions. No signing key is here — keys exist as pieces, and one piece signs nothing.
- One account One person’s rewards balance, to that account’s limits. A new withdrawal destination waits behind a cooling-off period.
- The working float The day’s issuance and payouts, under a per-day cap. That cap is the most any connected system can move in a day.
- One pool contract One of thirty-six, holding only its own balance. Staked in a different pool, you are outside the radius entirely.
- The treasury Cold, several signers, on a timer. It needs several people to agree and a public waiting period to pass unchallenged.
Through a pause the tokens stay yours: a pause halts movement, and ownership is untouched by it.
02 · Separate boxes
Break one.
Thirty-five
are untouched.
Every pool is its own contract holding only its own money. There is no shared pot to empty — which is why the worst case is one box, not the system.
- Thirty-five, carrying on
- One reached — and it stops there
A bank keeps everyone’s money in one building. This does not. Each pool is a separate contract with its own balance and its own address, and none of them can reach into another.
So the honest worst case is small and it is knowable in advance: one pool, and only the money in it. If your stake is in a different pool, nothing about it changed.
One key, three pieces, three places.
A piece on its own opens nothing.
03 · Where the money sits
Four places,
four rules.
Which one was reached is the same question as how much was taken.
-
Your wallet
DesignedHolds your tokens and your card rewards. Made for you at sign-up from an email or a phone number — you never handle a key, because the key is split into pieces kept in separate places.
-
The treasury
DesignedHolds the treasury allocation and the buyback reserve, in cold storage that several people have to sign for. A movement waits out a public timer before it can happen.
-
The working float
DesignedHolds the day’s issuance and payouts, and nothing more, under a cap on the day. Whoever is driving a connected system, the cap is where they stop.
-
The card rails
DesignedCard numbers sit with the licensed issuing partner, in the systems they are audited for. AXIS holds a reference to a card, never the card data.
Where the rewards come from
Every buy and every sell pays a small tax — 2% on the buy, 2% on the sell — straight to holders. That tax is what funds the rewards on your card. The stake stays staked until you unstake it. The rewards go to the card. The stake never goes to the card.
The reward path reaches the card. The stake path stops before it, every time — it is a different box, and only unstaking moves what is in it.
A cap on the day is the simplest safety there is. It moves what it is allowed to move in a day, then it stops. Not slow down — stop.
The cap is set in advance, and it is the most any connected system can move in a day.
CARD RAILS // DRAG TO TURN IT
04 · Defence in depth
Seven layers.
A layer that claims to stop everything cannot be checked. Each one says what it stops and what it hands on.
- Identity Designed Passwordless or multi-factor sign-in, short device-bound sessions, a hardware key on every privileged account. Hands on: a user who approves a bad action.
- Authorisation Designed The role that starts a movement never approves it. Hands on: two operators who agree.
- Key custody Designed Keys exist only as pieces, in separate hardware across separate providers. Hands on: a transaction the threshold legitimately signs.
- Contracts Designed Independent audit before mainnet, timers, several signers, and a pause that halts movement inside a block. Hands on: economic design.
- App and delivery Designed Server-side sessions, rate limiting, a strict content policy, signed webhooks, pinned dependencies. Hands on: the domain itself.
- Observation Designed Watchers on every published address, anomaly detection on withdrawals, an append-only log. Hands on: the first action.
- Limits and response Designed Caps on the day, velocity limits per card and account, cooling-off on a new destination, a rehearsed pause. Hands on: reversal — settlement is final.
05 · What if…
The questions
everybody asks.
Answered the way they are asked. Nothing here is behind a tap.
-
What if I lose my phone?
Your tokens are not on the phone. They are in a wallet made for you at sign-up, and the key to it exists only as pieces held in separate places — so a lost phone is a lost phone. You sign in again on a new one.
-
What if somebody gets into my account?
They reach ring two: one account’s rewards balance, to that account’s limits. Sending to a destination that has never been used before waits out a cooling-off period first, which is the window the watchers are for.
-
What if a pool gets attacked?
A pool holds only its own money and cannot reach into another. One of thirty-six is the worst case, and contracts carry a pause that halts movement inside a block while it is dealt with.
-
What if everything is paused?
A pause stops things moving. It does not change who owns what. Your tokens are still yours through it, and settlement is on a public chain, so you can check that yourself without asking AXIS.
-
What can the card actually do?
It spends the rewards that land on it, the same as any card. It cannot touch your stake. The stake and the card sit in different places, and the only way money crosses from one to the other is you choosing to unstake.
-
What if I stop using it?
Nothing moves on its own. Your stake stays exactly where you left it, staked, until you choose to unstake it — nobody, including AXIS, can move it for you.
The vault, in the app 
One card, one account 
Every stream, itemised 
Tap, and it is settled on-chain 
Read it yourself, on-chain 
An ordinary Tuesday
06 · The sequence
On today.
Next up.
AXIS publishes its security design ahead of its balances, so the claim and the calendar are the same document.
-
Engaged today
Live- 01Settlement on a public chain. Robinhood Chain, ID 4663. Every transfer on it is readable by anyone, without asking AXIS.
- 02Encrypted in transit, everywhere public. A valid certificate chain, served over HTTPS.
-
Before the first live balance
Designed- 01Server-side sign-in and sessions.
- 02Split-key custody engaged.
- 03Treasury funded, several signers, on a timer.
- 04Independent audit, published in full — findings and fixes, not a summary.
- 05Watchers on every published address, treasury and all thirty-six pools.
- 06Caps and velocity limits configured.
- 07Incident runbook rehearsed — named on-call, breakers pre-authorised.
Where AXIS meets a regulated counterparty, the counterparty holds the regulated data and AXIS holds a reference to it.
- IdentityKYC and sanctions screening at onboarding, through a regulated provider.
- Card schemeIssued by a licensed partner. Cardholder data stays in their scope.
- DataEncrypted in transit and at rest, retention minimised, a documented access path.
- DisclosureAudits published in full. A coordinated disclosure path with a graded bounty.
CHAIN 4663