Registration and certification
Hecto Walletone, which provides the virtual asset services and technology, holds the VASP registration and the ISMS certification. Hecto Innovation operates Octet.
| Item | Holder | Reference | Scope |
|---|---|---|---|
| VASP registration | Hecto Walletone Co., Ltd. | Accepted by Korea's Financial Intelligence Unit (KoFIU) in December 2021. A renewal was filed in October 2026 and is under review. | Other wallet custody and management |
| ISMS certification | Hecto Walletone Co., Ltd. | ISMS-KISA-2021-126, issued by KISA, valid from 4 August 2024 to 3 August 2027 | Virtual asset custody service and wallet solution (Ohai Wallet, Octet) |
| Listing | Hecto Innovation Co., Ltd. | Listed on KOSDAQ | Operator of Octet |
Eight controls before every signature
Four are set by your team in the console. Limits and allowlists are part of the wallet policy, and screening and Travel Rule are set up with us for each project.
Multi-signature
No single key moves funds.
ConsoleMulti-party approval
A second person confirms each withdrawal before funds move.
ConsoleTransfer limits
Caps are written into the wallet policy.
PolicyAllowlists
Withdrawals go only to listed destinations.
PolicyIP limits
Only your registered servers can call the API, and only your offices can sign in.
ConsoleScreening
Destination addresses are screened before signing.
Per projectTravel Rule
Data is exchanged before the transfer is sent.
Per projectAlerts
Your team is alerted to unusual activity.
ConsoleTravel Rule and screening are not included in Starter, are an add-on on Growth and are included from Scale. Compare plans
Travel Rule
Octet helps you meet your Travel Rule obligation on transfers to other VASPs. The messaging method and the integration steps are agreed for each project.
- Originator and beneficiary data are attached before the transfer is sent.
- The beneficiary VASP is checked before signing.
- The setup is fixed in the contract before mainnet access.
Key management
Wallets use multi-signature keys, so no single key can sign a transfer on its own.
- A withdrawal is signed only after the required approval in the console.
- One switch in the console pauses every withdrawal.
- Custody wallets, child addresses and withdrawal wallets keep holdings and outbound transfers apart.
Audit trail
Every deposit and withdrawal can be traced through the API and webhooks.
- Each deposit and each withdrawal state change is sent to your server by webhook.
- Balances and transaction history for each wallet are available through the API.
- Withdrawal requests, cancellations and pauses go through the API or the console.
Documents
Documents are listed here once they are published. Detailed material is shared after you contact us.
Security architecture and procedures are shared with your review team.