Menu Close
Close
Client Login

Security Statement

Last Updated: 23 October 2026

At PAA CAPITAL LLC, protecting the confidentiality, integrity and availability of client information and funds is a core obligation. This statement describes the safeguards we apply to your data, your account and our systems.

1. Our approach

Our controls follow a documented information-security and anti-money-laundering program and are guided by:

  • ISO/IEC 27001 principles and the NIST Cybersecurity Framework

  • the U.S. Gramm-Leach-Bliley Act and the FTC Safeguards Rule (16 CFR Part 314)

  • the security requirements of the EU GDPR

  • FATF recommendations for virtual-asset activities

2. Encryption

  • All connections to our website and online account platform are encrypted with TLS 1.2 or higher.

  • Our internal compliance systems and backups are stored on encrypted storage; backups are encrypted and kept off-site.

3. Account security

  • Two-factor authentication is available for every online account, and we strongly recommend enabling it.

  • Outgoing payments are confirmed with a one-time code before they are executed.

  • We will never ask you for your password or verification codes – by email, telephone or any other channel.

  • Our email domains are protected with SPF, DKIM and DMARC to make impersonation harder.

4. Infrastructure

  • Our website and services are protected by a web application firewall and DDoS protection.

  • Systems are kept up to date, and security updates are applied with priority.

  • Administrative access is restricted to authorised personnel, protected by individual credentials and logged.

5. Payment and digital-asset safeguards

  • Every client is identified and verified before any transaction, including document verification and liveness check.

  • Every client and counterparty is screened against the OFAC, UN, EU and UK sanctions lists, and every outgoing payment is screened before it is released.

  • Every incoming and outgoing stablecoin transfer (USDT, USDC) is screened before crediting or release – against OFAC-listed addresses, the freeze lists of Tether and Circle, and wallet risk scoring.

  • All transactions are monitored for unusual patterns, and every alert is reviewed and documented by our compliance team.

  • We do not hold clients’ digital assets in our own custody; stablecoin transfers are settled through regulated liquidity providers.

6. People and access

  • Access to client data is granted on a need-to-know basis only.

  • Staff receive regular training in data protection, information security and financial-crime prevention.

7. Oversight

Our anti-money-laundering program, including its security-relevant controls, is subject to an annual independent review. Our risk assessment is reviewed at least once a year.

8. Incidents and continuity

We maintain procedures to detect, contain and investigate security incidents and to notify affected clients and authorities where the law requires it. Encrypted off-site backups allow us to restore our systems.

9. What you can do

  • Use a strong, unique password and enable two-factor authentication.

  • Keep your devices and browser up to date.

  • Never share your login details or verification codes with anyone.

  • Always log in via paacapital.com, and report suspicious emails, calls or activity to us immediately.

10. Reporting a security concern

✅ Security Desk (preferred): https://support.paacapital.com
✅ Confidential hotline (sensitive matters): https://ethics.paacapital.com
✅ Postal: PAA CAPITAL LLC, 1001 S Main St, Ste 49, Kalispell, MT 59901, USA

Please do not send sensitive information by email.

11. Updates to this statement

We may update this statement to reflect technological, operational or regulatory changes. Updates are published on this page with a new date.