Clapp protects your assets and data at every layer, from crypto custody to who can access production systems. Here's how.
Regulatory Status
Clapp operates through registered entities in several jurisdictions:
Clapp Finance Limited is registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a money services business (MSB), registration No. N300000907. It has also applied for registration as a payment service provider with the Bank of Canada.
Clapp S.A. de C.V. is registered as a Bitcoin Service Provider (BSP) with the Central Reserve Bank of El Salvador, and has applied for registration as a Digital Asset Service Provider with the National Commission of Digital Assets (CNAD).
For the full list of entities and registrations, see Licenses and Registrations.
Institutional Custody with Fireblocks
Clapp stores crypto assets with Fireblocks, an institutional custody provider trusted by thousands of organizations worldwide. According to Fireblocks, its platform supports more than 200 blockchains and has secured more than 16 trillion USD in digital asset transactions.
Fireblocks uses multi-party computation (MPC) to split each private key into separate shares that never come together in one place, so no single device or server ever holds the full key. Transaction policies add another layer of control. Routine withdrawals follow pre-approved rules, while larger or unusual transactions require additional approvals.
Data Encryption
Clapp encrypts all data between your device and Clapp servers, and encrypts stored data at rest.
Protected Infrastructure
Clapp runs on cloud infrastructure from leading providers certified to SOC 2 and ISO/IEC 27001. Cloudflare protects the platform with a web application firewall (WAF), DDoS protection, and bot protection.
Continuous Monitoring
Clapp continuously monitors its systems with automated tools that flag unusual activity, and the team investigates every potential threat.
Strict Access Control
Only a small number of team members can access customer data and critical production systems, and only when their role requires it.
Identity and Device Security
Every team member signs in to work services with multi-factor authentication (MFA) using hardware security keys. Clapp manages all work devices centrally, keeps them up to date, and requires full-disk encryption.
Secure Development Lifecycle
Every code change goes through mandatory peer review and automated security checks before it reaches production.
Penetration Testing
Clapp regularly runs external and internal penetration tests to find and fix vulnerabilities.
Bug Bounty Program
Clapp runs a bug bounty program and works with independent security researchers worldwide to find and fix vulnerabilities. If you believe you've found a security issue in Clapp, send a report to [email protected]. The security team reviews every report and rewards qualifying vulnerabilities based on their severity.
Security Certifications
Clapp aligns its security controls with SOC 2 and ISO/IEC 27001 — two of the most widely recognized information security standards in financial services — and is preparing for independent audits against both.
Experienced Team
A team with many years of experience building and running critical fintech and crypto systems leads Clapp.
Keep Your Account Secure
Security works best when you take part too:
Turn on two-factor authentication (2FA) in the Clapp app.
Use an email address that only you can access, and turn on 2FA for it too.
Keep your phone, computer, and the Clapp app up to date.
Never share your password or 2FA codes. Clapp support will never ask for them.
Watch out for phishing emails and messages that pretend to come from Clapp. Don't click links or open attachments you didn't expect.
Before you sign in, check that you're on clapp.finance or in the official Clapp app.