Security for REX is multi layered. At the infrastructure level, the platform runs behind DDoS protection from a provider such as Cloudflare, shielding it against common volumetric and application layer attacks. At application level, regular security audits, code reviews and penetration tests are scheduled to identify and remediate vulnerabilities before they can be exploited.
Sensitive data such as passwords, API keys and private keys are handled using best practice. Passwords are hashed using modern algorithms, keys and secrets are stored in Vault, and KYC documents in encrypted storage. Access to administrative consoles is protected by role based access control and secured network paths. Background workers that process deposits, withdrawals and synchronisation tasks are designed to be idempotent, so that failures do not result in inconsistent balances.
On the user side, two factor authentication, address whitelisting, withdrawal limits and clear notifications for key account events help reduce the risk of account takeover or social engineering. Push notifications and email alerts confirm deposits, withdrawals, login attempts and important security events, so that users can respond quickly if something looks suspicious.
All of this is tied together by operational practices that include change management, logging and audit trails. Every significant administrative action and system change is recorded, which supports both internal governance and external audits.