This page is written to be usable as an RFP artifact. Where a control is absent, it says so — an overview that reads as uniformly green is not a security document, it is marketing.
The one thing to understand first
The system is non-custodial. No component can move your funds beyond what you explicitly signed for, and the constraint is enforced on-chain rather than by service-side policy.
The relayer key is not a custody key. Losing it means an attacker can execute trades the caps already permit — an execution-quality and nuisance problem, not a drain.
Defence in depth on limits
Execution rate limits (5 per hour per user) are enforced in both the contract and the executor service. A limit that exists in only one layer disappears the moment that layer has a bug.Deployment model
Scienter is self-hosted. There is no vendor-operated multi-tenant instance, which changes the shape of the risk:What this removes
No vendor-held customer data pool to breach. No shared-tenancy isolation risk. No vendor employee with production access to your data.
What this moves to you
Host hardening, network exposure, key storage, patching, and backup are the operator’s responsibility. See Data handling.
Authentication posture, stated plainly
Full detail: Authentication.Read-only agent surface
The MCP tool layer is read-only by construction: every capability resolves through a registry to a reading function, and clustering is called withpersist=False, asserted by a test.
This matters because the caller is frequently a language model acting on untrusted input. An inferred entity edge written into the graph on a model’s say-so would be a write reachable from a prompt.
Known gaps
No SOC 2, no ISO 27001, no completed penetration test
No SOC 2, no ISO 27001, no completed penetration test
None of these exist today. See Compliance roadmap and Penetration testing for the honest status of each.
Oracle dependency
Oracle dependency
Outcome binding depends on an oracle verifier. A compromised or unavailable oracle degrades the ledger’s outcome record. See
docs/SECURITY_MODEL.md §6.Guardian quorum is a trusted set
Guardian quorum is a trusted set
A hostile guardian quorum can pause the system. It cannot touch funds, but availability is not guaranteed against it. §4.4.
Auto-execution sits at the weak end of the publisher's exclusion
Auto-execution sits at the weak end of the publisher's exclusion
Documented rather than argued away. The per-trade confirmation toggle defaults to ON for this reason. See Compliance.
Full threat model
docs/SECURITY_MODEL.md in the repository carries the complete analysis: assets and actors, trust boundaries, five enumerated adversaries (hostile executor, relayer, router, guardian quorum, frontend), the cost of the guardian pause, accepted residual risks, and a section titled “What this does not protect against.”
Scienter publishes impersonal market signals of general and regular circulation. Nothing here is investment, legal, or tax advice, or a recommendation to buy, sell, or hold any asset. Scienter is not a registered investment adviser or broker-dealer. Trading digital assets can result in the total loss of your funds — see Disclaimers for the full text.