Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.prudra.dev/llms.txt

Use this file to discover all available pages before exploring further.

​
Security overview

Prudra is designed around the principle that private keys never exist in plaintext outside of KMS hardware. Every critical security property is enforced at the database level, not the application level.

​
Security layers

​
Key custody

Managed wallet private keys use envelope encryption:
  1. Each wallet has a private key (DEK)
  2. The DEK is encrypted with the Key Encryption Key (KEK)
  3. The KEK lives in KMS hardware — never in application memory beyond the signing window
  4. Only the encrypted ciphertext is stored in Postgres
Zero plaintext private keys are ever persisted to disk or logged.

​
Payment security

  • Replay protection: ERC-3009 nonces and on-chain transaction hashes use @@unique constraints at the database level
  • Challenge harvesting: Rate limited at 20 challenges per IP per 60 seconds
  • Signature verification: HMAC-SHA256 and on-chain signature verification for every payment

​
Webhook security

All webhook deliveries are signed with HMAC-SHA256. The signature covers the raw body and timestamp to prevent replay attacks.

​
Sub-pages

Key custody

Envelope encryption, KMS hardware, and key rotation.

Audit logs

Payment logs, key usage logs, and compliance exports.