They have a reassuring security page[0]. It&#x27;s nice to see they&#x27;re enforcing good practices, I especially appreciate their &quot;no-link email policy&quot; where they will never send you links in emails, which seems like a great way to head off phishing attempts. I hope they actually present this to users in some way during sign-up though, or it won&#x27;t be of much help unless a user manually navigates to the security page and reads through most of it.<p>I&#x27;m a little disappointed that they only have level 2[1] HSMs in the cloud, as I would be uncomfortable protecting my hot wallet keys with only tamper evident protections, rather than level 3+ that actually attempt to detect intrusion and delete keys. Bitcoin makes for very quick stealing once you have keys, so reactive defenses against key loss don&#x27;t help much as you&#x27;re literally in a race condition with the attacker to empty the wallet (you into a non-compromised one, the attacker into their own). But I would assume they weighed cost&#x2F;risk and I&#x27;ve never heard of a security compromise of Amazon&#x27;s HSMs so it was probably a reasonable choice.<p>edit: I should also applaud their use of PGP and (explicit) respect for responsible disclosure.<p>[0]: <a href="https:&#x2F;&#x2F;exchange.gemini.com&#x2F;security" rel="nofollow">https:&#x2F;&#x2F;exchange.gemini.com&#x2F;security</a><p>[1]: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;FIPS_140-2#Level_2" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;FIPS_140-2#Level_2</a>