Security at every layer.
From how your crypto keys are protected, to your account, our infrastructure and the checks that keep money out of the wrong hands, Hummingbird builds to the standards leading exchanges use today.
No single private key. Ever.
Crypto is protected with institutional-grade MPC custody, the same kind of technology banks and exchanges rely on. Instead of one private key that could be stolen, each key exists only as separate shares that never come together.
Multi-party computation
Transactions are signed by several parties together, each holding one key share. The full key is never assembled.
Secure hardware enclaves
Signing and approval rules run inside isolated hardware, protected from tampering by outside or inside actors.
Distributed key shares
Key shares are spread across multiple tier-1 cloud environments, so no single data centre is a point of failure.
Policy-controlled transfers
Every outgoing transfer is checked against strict approval rules and blocked if it doesn’t meet them.
Kept apart from ours.
Your funds are held in regulated bank accounts and secured wallets that are separate from our company accounts. We use world-class payment service providers for every transaction.
- Segregated client funds
Held separately from Hummingbird’s own money. - No card data stored
We never store card numbers or digital wallet passwords and keys. - 3D Secure and tokenised payments
Card payments are verified with your bank, and every transaction is tokenised and encrypted end to end. - Every withdrawal reviewed
Withdrawals are checked by our team before they’re processed.
Only you get in.
Security starts in the app, with protection on every log-in, every session and every transfer out.
Biometric and PIN log-in
Unlock with your fingerprint or a PIN.
2FA on every transfer out
Outbound crypto transactions need a second factor.
Secure sign-in
OAuth log-in with token authentication on every session.
Encrypted connections
TLS encryption for all data in transit.
Hardened, monitored and tested.
Your sensitive data is encrypted and held in a secure database with one of the world’s most prominent data centres, with every step taken to ensure GDPR compliance.
- Zero-trust access: 2FA and least-privilege, role-based permissions
- Private network, with firewalls and IP allowlisting
- DDoS detection and protection
- Hardened servers with only the necessary ports open
- Secure development to OWASP best practice
- Regular independent penetration testing
- Every access and system call logged and monitored
- Proprietary software, with background checks for all staff
We fight fraud and money laundering.
A strict AML and CTF policy starts with verifying the identity of every user. We monitor every deposit and withdrawal, and screen against FATF and OFAC sanctions lists to keep money out of the wrong hands.
Your data is private.
We follow the EU General Data Protection Regulation (GDPR), and we will never sell or give away your personal data beyond what’s needed to deliver our services.
Read our privacy policy