P2P.org Security and Compliance
Institutional due diligence evidence
P2P.org's security and compliance documentation lets institutional clients verify every claim against an independent report rather than a marketing page. P2P.org is SOC 2 Type II attested and ISO/IEC 27001:2022 certified, with penetration tests, independent assurance, and smart contract audits released to qualified institutions on request after a short identity verification.
Assessed by Independent Auditors
Issued by KirkpatrickPrice, BSI Group, Sumsub Sentinel, and the Blockchain Security Standards Council (BSSC). Each is reassessed on a recurring cycle, with current reports available through the security and compliance portal.
Attested
SOC 2 Type II
Certified
ISO 27001:2022
Awarded
Sumsub Sentinel
Conformance with
BSSC Standards
Report a Vulnerability
P2P.org accepts vulnerability reports through a short anonymous form. No account or contact details are required. Every report is triaged, and reporters who choose to identify themselves are credited where they consent to it.
Audit and Assurance Reports
Reports across four categories: SOC 2 audits, penetration testing, independent assurance, and smart contract security. Each is requestable individually through the compliance portal, subject to a short identity verification.
ISO/IEC 27001:2022 Certification
ISO/IEC 27001:2022 Certificate
Certification of P2P.org's information security management system, issued by BSI Group under certificate IS 845360. Scope covers engineering, operations, data management, and validation. Valid through August 2029.
SOC 2 Attestation
SOC 2 Type II Report
Independent audit by KirkpatrickPrice confirming P2P.org's controls were suitably designed and operated effectively to meet the AICPA Trust Services Criteria for security, availability, confidentiality, and processing integrity. Achieved December 2025.
SOC 2 Type I Report
Independent audit by KirkpatrickPrice confirming P2P.org's controls were suitably designed to meet the AICPA Trust Services Criteria at a point in time. Achieved January 2024.
External Penetration Test
P2P.org External Pentest Report
Independent infrastructure penetration test by Decurity covering P2P.org's web, backend, and middleware components. Validated overall platform resilience. All discovered issues were remediated before report publication.
Independent Assurance
P2P.org Staking ISAE 3000 Key Ceremony Report
Independent assurance report by PricewaterhouseCoopers AG on P2P.org's Key Ceremony and related processes and controls. Conducted in accordance with the Digital Asset Custody Standard (DACS) by CMTA.
Smart Contract Security Audits
ETH2 Depositor & ETH Staking Fee Distributor Security Audit Report (v.2)
MixBytes audit verifying updates to the ETH2 Depositor and Fee Distributor system, with specific focus on oracle-based reward distribution reliability.
ETH2 Depositor & ETH Staking Fee Distributor Security Audit Report
MixBytes audit of the original ETH2 Depositor and Fee Distributor system covering deposit mechanics, fee distribution logic, and oracle interactions.
TON Nominators Staking Pool Security Audit Report
Quantstamp audit of P2P.org's TON staking pool contracts, reviewing deposit and withdrawal mechanisms, controller permissions, and reward distribution logic.
P2P.org Staking Lending Proxy Security Audit Report
MixBytes audit of the Staking Lending Proxy contracts enabling yield generation via Ethena, verifying proxy deployment safety, calldata validation logic, and adherence to best practices for contract transparency and parameter checks.
P2P.org SSV Integration Security Audit Report
MixBytes audit of smart contracts integrating P2P.org's staking services with the SSV Network, ensuring secure validator registration and token management.
P2P.org SSV Integration Diff Audit (v1)
Differential audit verifying fixes and updates to the SSV Integration codebase, confirming resolution of previous findings and adherence to best practices.
P2P.org Staking Fee Depositor Diff Audit (v1)
MixBytes audit reviewing code changes to the Staking Fee Distributor contracts responsible for ETH deposits and fee distribution between clients, referrers, and services.
P2P.org ETH Allocation Share Security Audit Report
MixBytes audit of the ETH Allocation Share contracts, verifying secure allocation logic, Merkle-proof distribution, and zero-address protections.
P2P.org Lending Proxy Security Audit Report
MixBytes audit of the Lending Proxy smart contracts, ensuring secure integration with lending protocols, accurate fee calculations, and protection against signature replay and front-run attacks.
Controls
Security Controls Across Four Categories
P2P.org maintains 35 monitored security controls across four categories, continuously verified and timestamped in the compliance portal. The summary below reflects controls assessed under the SOC 2 Type II attestation and the ISO/IEC 27001:2022 certification.
Infrastructure Security
- Access control procedures documented for adding, modifying, and removing user access
- Production systems remotely accessible only by authorized employees over approved encrypted connections
- Log management tool in place to identify events affecting security objectives
- Firewalls configured to prevent unauthorized access, rulesets reviewed at least annually
- Formal policies governing vulnerability management and system monitoring
Organizational Security
- Electronic media containing confidential information purged or destroyed, with certificates of destruction issued per device
- Code of Conduct acknowledged by all employees at hire, enforced with a disciplinary policy
- Visitors signed in, badged, and escorted by an authorized employee in data centers and secure areas
Product Security
- Datastores housing sensitive customer data encrypted at rest
- Control self-assessments conducted at least annually, with corrective actions completed within committed SLAs
- Penetration testing performed at least annually, with a remediation plan implemented against SLAs
Internal Security Procedures
- Business Continuity and Disaster Recovery plans in place, with communication plans for loss of key personnel
- Formal secure development methodology governing development, acquisition, implementation, and change
- Formalized whistleblower policy with an anonymous reporting channel
- Board briefed at least annually on cybersecurity and privacy risk, under a documented oversight charter
- Customers notified of critical system changes that may affect their processing
How P2P.org Handles Client Data
P2P.org's data handling practices are governed by the P2P.org Privacy Policy and independently verified under the SOC 2 Type II attestation and ISO/IEC 27001:2022 certification. Key commitments:
Client data containing confidential information is purged or removed from the application environment when clients leave the service.
Datastores housing sensitive customer data are encrypted at rest.
Network segmentation prevents unauthorized access to client data across all infrastructure.
Need Something Not in the Portal?
Diligence teams needing a completed security questionnaire, a data processing agreement, or a call with the P2P.org security team can request one directly.
Frequently Asked Questions
Help centerYes. P2P.org achieved SOC 2 Type II attestation in December 2025, audited by KirkpatrickPrice against the AICPA Trust Services Criteria for security, availability, confidentiality, and processing integrity. The report is available on request.
A Type I report assesses whether controls are suitably designed at a single point in time. A Type II report additionally tests whether those controls operated effectively across a review period. P2P.org holds both.
P2P.org's contracts have been audited by MixBytes and Quantstamp, covering the ETH2 Depositor and Fee Distributor, TON staking pools, SSV Network integration, lending and staking proxies, and ETH allocation shares. Each report is listed above and available on request.
It is a compliance standing issued by Sumsub, one of the independent assessors listed above, and is reassessed on a recurring cycle alongside P2P.org's other certifications.
Yes. P2P.org's information security management system is certified to ISO/IEC 27001:2022 by BSI Group, under certificate IS 845360. The scope covers engineering, operations, data management, and validation, and the certificate is valid through August 2029. The certificate is available on request.
Every report listed above is requestable individually through the compliance portal, subject to a short identity verification. Diligence teams needing a completed security questionnaire, a data processing agreement, or a call with the security team can request one directly.
Client data is governed by the P2P.org Privacy Policy and independently verified under the SOC 2 Type II attestation and ISO/IEC 27001:2022 certification. Datastores holding sensitive customer data are encrypted at rest, and confidential data is purged when clients leave the service.
Slashing protection is part of the infrastructure security controls assessed under the SOC 2 Type II attestation, which cover access control, encrypted operator access, monitoring, and formal vulnerability management across production systems.