Building on Avalanche? Ava Labs can cover up to 75% of your audit, and we take 10% off our quote. Avalanche audits: up to 75% covered. See how

Build a digital asset program whose controls hold in production.

Discuss your scope

We review custody, settlement, and wallet infrastructure for banks, asset managers, fintechs, and payment firms.

When this fits

Bring us in while the architecture can still change.

Before you choose architecture or vendors

Evaluate custody, settlement, and wallet options while the architecture can still change.

When adding a product or integration

Challenge a new custody provider, fintech partner, or core-system integration before it ships.

Before launch or external review

Test whether controls, recovery, and evidence hold up to production and outside scrutiny.

When security work has piled up

Findings, vendors, and open items have accumulated. We tell you what to fix first.

Where it breaks

A custody platform is only one part of the security model.

We review the custody platform alongside signing, identity, integrations, and recovery.

Check the controls within each stage and across each handoff.
01

Ownership & approvals

Who can approve what, who owns each control, and what happens when they leave.

02

Custody, signing & recovery

Custody architecture, MPC and HSM models, signing policy, key ceremonies, and break-glass access.

03

Platforms & integrations

Wallet, settlement, API, identity, and core-system boundaries reviewed as one system.

04

Launch & operating readiness

Monitoring, incident response, change control, and remediation ownership before you go live.

Your engagement team

Meet the specialists

The team brings experience leading security inside operating companies.

Piotr Cielas portrait

Piotr Cielas

Principal Advisor

Head of Security at Agora, responsible for security, data protection, and corporate IT risk. Earlier at EY, led assessments across financial services, healthcare, and government.

Piotr Cielas portrait

Piotr Cielas

Principal Advisor

Piotr is Head of Security at Agora, where he oversees information security, data protection, and corporate IT risk management. He brings both industry and consulting experience, having led information security advisory engagements and security program development for global financial institutions and large organizations. Earlier in his career, Piotr was a Senior Cybersecurity Consultant at Ernst & Young (EY), leading security assessments across financial services, healthcare, and government. He holds CEH, OSCP, and OSWE certifications, has contributed to the CVE program, and is the inventor of multiple U.S. patents related to information security and blockchain technology.
LinkedIn
Michal Bajor portrait

Michal Bajor

Specialist Advisor

Security specialist with 60+ Web3 reviews across DeFi, L1s, bridges, oracles, and other critical infrastructure. At Kraken, worked on the security of funding services, custody, APIs, and on-chain systems.

Michal Bajor portrait

Michal Bajor

Specialist Advisor

Michal is a security expert with a Master's in ICT, three published research papers, and active academic research in blockchain technology. He has reviewed 60+ Web3 projects across DeFi, L1 systems, bridges, oracles, and other critical ecosystem components. At Kraken, he was responsible for security across crypto and fiat funding services and custody, B2B APIs, on-chain monitoring, smart-contract risk, and architectural and compliance reviews. Earlier at EY, he conducted web application penetration tests, participated in red-team activities, and worked across defensive security responsibilities; at Cisco, he supported Security Advisory penetration-testing work and internal cybersecurity training.
LinkedIn
Timur Güvenkaya portrait

Timur Güvenkaya

Founder & Partner

Led a security engineering practice for Rust and non-EVM systems across Substrate and NEAR. Earlier, built vulnerability-detection engines at Invicti used by Fortune 50 and public-sector organizations.

Timur Güvenkaya portrait

Timur Güvenkaya

Founder & Partner

Timur founded Guvenkaya after seeing teams reduce security to code review while their real risk spans architecture, infrastructure, operations, custody, and launch decisions. Before Guvenkaya, he established and led a security engineering practice for complex blockchain systems, specializing in Rust-based and non-EVM ecosystems including Substrate and NEAR. Earlier at Invicti, he helped build enterprise vulnerability-scanning and security detection engines used by Fortune 50 companies and public-sector organizations. He holds the CISSP certification.
LinkedIn
Meet the full team

Tell us what you need to secure.

Describe the program, vendors you are considering, and decision deadline. We will help define the scope.

Discuss your scope