> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ix.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Security model

> How IX RWA protects funds and data — the trust boundaries, the money-path invariant, and audit status.

Security is a precondition for real capital, not a feature added later. IX RWA's security model rests on one principle: **the blockchain is the source of truth, and every movement of value is derived from verified on-chain events.**

## The money-path invariant

Ownership and payouts are never taken from what a client claims — they are read from the chain and verified before anything is recorded.

```mermaid theme={null}
flowchart LR
    U[User action] --> TX[On-chain transaction]
    TX --> EV[Contract event]
    EV --> CHK{Verified?<br/>sender, amount, event}
    CHK -->|yes| REC[Recorded and eligible for payout]
    CHK -->|no| REJ[Rejected]
```

This invariant gates the transition to real money: investment and claim records are bound to a verified on-chain transaction, the payer is bound to the recorded owner, and amounts are read from the event rather than the request.

## Trust boundaries

| Layer                 | Control                                                                                         |
| --------------------- | ----------------------------------------------------------------------------------------------- |
| **Wallet / identity** | Non-custodial. Connecting a wallet is the only identity; IX RWA never holds your keys.          |
| **Contracts**         | Upgradeable behind beacon proxies; upgrade authority moves to multisig / governance at Phase-2. |
| **Off-chain records** | Derived from verified on-chain events; reconciled against the chain.                            |
| **Admin**             | Separate, authenticated administrative access, isolated from investor funds flow.               |

## Audit status

<Warning>
  IX RWA is on **testnet**. A **third-party security audit** is a prerequisite for mainnet launch; results and the audit report will be published here. Until then, do not treat testnet as production-secure. See the [roadmap](/why-ix-rwa#roadmap).
</Warning>

## Responsible disclosure

If you believe you have found a vulnerability, please report it privately to the team rather than disclosing publicly. A formal disclosure policy and contact are published with the audit at launch.