Built like a bank, audited like one
Zelo uses the same patterns banks use — atomic ledgers, RLS isolation and immutable audit logs — to keep your value safe.
Mandatory 2FA
Google Authenticator (TOTP) is required for every wallet action — redeem, transfer and settlement. Backup codes let you recover if you lose your phone.
Authenticator-based password reset
Forgotten passwords are reset using a fresh 6-digit Authenticator code — no email links that can be intercepted.
Atomic ledger
All balance changes go through Postgres functions with non-negative invariants. You can never overspend.
Row-level security
Every table is protected by RLS. Users can only ever see and act on their own data.
Role separation
Admin privileges are stored in a dedicated table with a security-definer check, preventing privilege escalation.
Per-user transaction limits
Admins set per-transaction, daily and monthly caps for transfers and settlements to contain blast radius.
Immutable audit log
Every admin action — balance adjustments, KYC reviews, 2FA resets, password resets, settlement processing — is logged forever.
KYC document privacy
ID documents and selfies live in a private storage bucket, accessed only via short-lived signed URLs.
Encrypted at rest
All database content and storage objects are encrypted at rest by our infrastructure provider.
Manual settlement & showcase review
Every payout and every Showcase listing is reviewed by a human before going live.
Ban & freeze controls
Suspicious accounts can be instantly frozen by admin while activity is investigated.