Foundry’s risk assessment process requires management to identify significant risks involved with running validators for the supported protocol networks and implement appropriate measures to address those risks. The assessment includes the documentation and rating of risks associated with network architecture and vulnerabilities, staking operations, and existing integrations. This process is performed on a quarterly basis to ensure a timely response to risks identified.

Foundry’s Know Your Customer (KYC) process is required for all customers and business partners as part of onboarding on both the mining and staking sides of the business. The decision engine behind Foundry’s KYC powers business verification (KYB), Anti-Money Laundering (AML), and fraud checks on Ultimate Beneficial Owners (UBOs) and other stakeholders.

Foundry has a mandatory cybersecurity awareness program for all employees. New hires are trained on multiple topics, including identifying security threats on various channels and reporting phishing attempts to the internal security operations team. The program is updated on an annual basis and required for all team members.

Foundry has internal policies to manage access to data and physical systems. Access to proprietary systems and third-party platforms is granted on a role basis, and permission sets must be pre-approved by the internal security team.

Foundry’s bare metal infrastructure with failover at co-location facilities was designed and built to minimize the likelihood of slashing events. Foundry commits to provide a 99.9% production uptime to prevent missed attestations and has policies in place to account for slashing events and missed rewards in specific instances.

Foundry monitors all its staking nodes 24 hours a day, seven days per week. Foundry informs customers of all scheduled maintenance that might impact block production at least seven days in advance. The Foundry team is available to assist customers and integrated partners with security, account, and operations issue resolution.

Foundry has multiple layers of protection for Distributed Denial of Service (DDoS) prevention, including engaging a DNS provider. Foundry runs failover infrastructure to monitor and mitigate the risk that a DDoS attack poses to a validator and the tokens delegated to it. Foundry maps DDoS risk and protection measures on a protocol basis according to architectural features of the supported networks (whether they use sentry nodes, for example).

Foundry has internal policies to manage access to data and physical systems. Access to proprietary systems and third-party platforms is granted on a role basis, and permission sets must be pre-approved by the internal security team.