Least privilege, enforced automatically
Foolproof Token permissions give each user only the access their standing has earned, and take it back as soon as their behavior changes. Nobody has to remember to revoke anything.
Security
Built for hostile territory.
Epeius works where value moves fast and attackers move faster. How we design our products, run our operations and present our company is all meant to shrink the attack surface, for us and for the platforms we protect.
Secure by design
The products are the first line of defense.
Continuous, not one-time
Woven reassesses users as they act instead of relying on a single check at onboarding. A trusted account that turns hostile loses its access when the behavior changes, not at the next audit.
No password vault to breach
Universal iD is passwordless by design. With no central store of user passwords, there’s nothing for a LastPass-style breach to steal.
Guardrails before the signature
Aegis OS gives users transaction context and risk warnings before they sign, while a mistake can still be prevented.
How we’ll contact you
Know us from an imposter.
Impersonation is one of the most common attacks in digital assets. It’s also why we keep our team out of public view. Here’s what a real message from Epeius will never ask you to do.
Epeius will never
- Ask for your private keys, seed phrase or passwords
- Ask you to move funds or sign a transaction to “verify” an account
- Ask you to install software or a browser extension sent over chat
- Offer support through unsolicited direct messages
Our only official channels
- Webepeius.id
- EmailAddresses ending in @epeius.id
Epeius doesn’t currently use social media for support or announcements, so treat any social account offering Epeius help as an imposter.
Not sure a message is real? Reach us through the contact form on this site before you act on it.
Responsible disclosure
Found a vulnerability? Tell us first.
We welcome reports from security researchers and treat every credible one as a priority.
Send reports to
security@epeius.id
- Include the details. Describe the issue, the affected product or URL, and the steps to reproduce it.
- Keep it contained. Don’t access, change or keep data that isn’t yours, and don’t disrupt live services.
- Give us time. Allow us a reasonable period to fix the issue before you disclose it publicly.
We’ll confirm we’ve received your report and keep you updated while we work on a fix.
Why doesn’t Epeius publish its team?
In digital assets, a public org chart is a target list for phishing, impersonation and social engineering. We keep a low profile on purpose and share leadership details with clients and partners under NDA.
How can I tell whether a message from Epeius is real?
We will never ask for private keys, seed phrases or passwords, never ask you to move funds or sign a transaction to verify an account, and never offer support through unsolicited direct messages. If you’re unsure, contact us through the form on this site before you act.
Can we review your security documentation?
Yes. We share security documentation with prospective clients and partners under NDA as part of due diligence. Request a diligence call to start.
How do I report a vulnerability?
Email security@epeius.id with a description, the affected product or URL, and steps to reproduce. Please don’t access data that isn’t yours, and give us reasonable time to fix the issue before disclosing it.
Can compliance records be altered after the fact?
Lynceus writes screening results and decisions to Horkos, an onchain audit trail kept through our partner, so the record is tamper-resistant.
Due diligence
Running a vendor review?
We share security documentation, leadership details and references with prospective clients and partners under NDA.