How your money is kept safe

Every rial is recorded twice

Your balance is not a number stored somewhere and edited. Every movement, from buying Tether to a withdrawal fee, is recorded in a double-entry ledger: one side debited, one side credited, and the two always equal. Entries are never deleted or edited; a mistake is corrected with a compensating entry that stays in the history itself.

Every day the ledger is compared with what the bank accounts and wallets actually hold, and any difference, however small, stays open until someone explains it.

Nobody moves money alone

• Every withdrawal is approved by someone other than the person who requested it.
• Staff allowed to move money cannot reach those screens without two-step sign-in.
• Nobody can give themselves a new role or permission.
• Everything done in the back office is written to an audit log under the name of whoever did it, and cannot be deleted.

A new destination waits

When you add a new address or account for withdrawals, it takes a while before it can be used. The most common theft at exchanges is someone getting into an account and immediately sending the funds to themselves; the gap is the time you need to notice and lock the account.

The keys are not on a server

Each customer's deposit address is derived from the public key of the exchange's wallet. A public key can make addresses and cannot spend anything. The private keys are on custody devices away from the servers, and withdrawals are signed on those devices. The system refuses any private key someone pastes into it by mistake.

Deposits are credited once the network has confirmed them deeply enough. If the network later reverses a transaction, that is detected automatically and recorded for review.

Your part

No one at Sarafi Iranian will ever ask for your password, sign-in code, or two-step code. Anyone who asks is not us.

• Turn on two-step sign-in.
• Sign in only at sarafiranian.com, and look at the address before typing your password.
• If you get a message about a sign-in or a withdrawal destination you did not make, contact support straight away.