Custody you could defend to a board.
Ulltimate Rewards holds $2.4B for 120,000 investors. Every dollar of that protection rests on six pillars — designed so a CFO can sign off and a regulator can audit.
95% cold storage
The vast majority of customer assets are held in offline, geographically distributed cold-storage vaults managed by two independent institutional custodians. Only the 5% needed for daily withdrawal liquidity is held in hot wallets — and that exposure is fully insured.
SOC 2 Type II certified
Annual third-party audit covering security, availability, processing integrity, and confidentiality. Our latest unqualified opinion is available to enterprise customers under NDA.
Hardware-key 2FA
Every account supports WebAuthn / FIDO2 security keys (YubiKey, Titan), plus TOTP authenticator apps. SMS 2FA is available but discouraged. Withdrawals always require a fresh second factor.
Row-level data isolation
Customer data sits behind Postgres row-level security policies. Each query is scoped to your session's user ID at the database layer — not just the app — so a bug in application code cannot leak another customer's records.
Admin-reviewed withdrawals
Every withdrawal above a small daily threshold passes through a human review queue. Suspicious patterns — new addresses, unusual amounts, recent device changes — trigger an out-of-band confirmation call before funds move.
Incident response
We run a 24/7 security operations centre. Suspected incidents are triaged within 15 minutes, materially affected customers notified within 24 hours, and a public post-mortem published within 30 days. We have had zero customer-facing security incidents since launch.
Regulated where it matters.
Ulltimate Rewards is registered as a Money Services Business with FinCEN in the United States, holds a Virtual Asset Service Provider (VASP) registration in our European hub, and operates under the FCA's cryptoasset registration framework in the United Kingdom. We complete annual independent financial audits and publish a Proof-of-Reserves attestation every quarter.
We follow the FATF Travel Rule for every withdrawal above the regulatory threshold and screen all deposits against OFAC, EU consolidated, and UK HMT sanctions lists in real time. Suspicious activity reports are filed where required. Our compliance team is led by a former senior FCA regulator.
Services and product availability vary by jurisdiction. Stablecoin yield plans are not available to US persons in states that have not granted the necessary licences. We will always tell you exactly what is available to you in your country during account setup.
Security is a partnership.
The strongest custody architecture in the world cannot protect you from a re-used password or a phishing email. We require a unique password and 2FA on every account, and we recommend a hardware security key. Enable withdrawal address allowlisting so funds can only ever leave your account to addresses you have pre-approved. Never share your seed phrase, never approve a transaction you do not understand, and never send code or passwords to anyone — including someone claiming to be Ulltimate Rewards support.
Report a security concern