> For the complete documentation index, see [llms.txt](https://docs.theo.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.theo.xyz/security-and-transparency/overview.md).

# Overview

Theo's processes, practices, and features to maintain transparency and security

At Theo, our ethos is **verify, not trust.** Security and transparency are engineered into our products from day one, with verifiability at the core of each. This means regular audits for our smart contracts, institutional custody and risk controls, and ongoing attestations conducted by third-party auditors. Check the next page to learn more about the standards we uphold to maintain transparency and security throughout the lifecycle of our products.

### What is provable and what is attested

All onchain smart contracts and their claims are provable, including audits, roles, access control, timelock, and upgradeability.

The multisig quorum is provable. Anyone can read the Safe's signer set and threshold from chain at any time, and the commands to so are included in these docs.

The Guardian, Minter, and Canceller are EOAs operated under Fordefi MPC custody. MPC control is not observable onchain, because a transaction signed through MPC is byte-identical to one signed by a single key. Control of those three addresses rests on custody attestations rather than chain data. We state this so reviewers know which claims to check against chain and which to check in diligence.

### Where to verify each claim

| Claim                                     | Page                                                                                        |
| ----------------------------------------- | ------------------------------------------------------------------------------------------- |
| Audit scope, findings, and remediation    | [Audits](/security-and-transparency/audits.md)                                              |
| Who holds every privileged role           | [Privileged roles & access control](/security-and-transparency/roles-and-access-control.md) |
| Delays before a change takes effect       | [Upgradeability & timelocks](/security-and-transparency/upgradeability-and-timelocks.md)    |
| Cross-chain message verification and caps | [Bridge security](/security-and-transparency/bridge-security.md)                            |
| Which contract is at which address        | [Deployed addresses](/developers/deployed-addresses.md)                                     |

Every role, delay, and bridge setting on those pages carries the terminal command that reproduces it against a public RPC. The commands need [Foundry](https://book.getfoundry.sh/cast/) and nothing else. No API keys, no accounts, and no dependency on data we host.

### Reporting a vulnerability

Disclose to <security@theo.xyz>. See [Bug bounty](/security-and-transparency/bug-bounty.md) for the current process.