Audits and code
Here is our audit stance, stated plainly. We would rather put our budget and attention into architecture you can verify than into a certificate.
Has Ownbit's code been audited?
- Ownbit has not commissioned a separate commercial (paid) audit, and does not plan to.
- The codebase has been in production use for years.
- It has been through security review with several leading AI models.
- The MultiSig smart contracts (EVM V10, V11, V21 and the Solana program) were reviewed in October 2026 by GPT-6-Astra and Opus 5. Both reports are published in full on the trust page.
- The on-chain MultiSig contracts are public for anyone to review at github.com/bitbill/ownbit-multisig-contracts.
What we do not claim: ISO 27001, SOC 2, or third-party audits from firms such as CertiK, SlowMist or Trail of Bits; NDA client-commissioned audits; or reproducible builds. We prefer to be straight about what exists rather than imply a certificate we don't hold.
What is open source since 5.0
From Ownbit 5.0, the code that touches your private keys in the iOS app — mnemonic generation, key storage (Ownbit Vault v2 from 5.1), key derivation and transaction signing — is open source under the MIT license at github.com/bitbill/ownbit-app-50, together with the JavaScript signing bundles both apps load; the Android core is to follow. The user interface and the code that talks to Ownbit's servers stay closed, and your funds never depend on their secrecy: security rests on open cryptographic standards, the open key-handling core and the public on-chain contracts, all of which you can verify independently.
What is actually open and verifiable
- The iOS key-handling core and the shared JavaScript signing bundles — mnemonic generation, Ownbit Vault v2 key storage, derivation and signing — at github.com/bitbill/ownbit-app-50, with the SHA-256 of every signing bundle published.
- The on-chain MultiSig contracts that govern funds — open source, and you can confirm the contract at your address matches them on a block explorer.
- The QR signing encoding — published at bb_sign_encoding.txt so you can decode any signing QR to plaintext.
- Standards conformance — import a standard seed and confirm Ownbit derives the same addresses (BIP32/39/44).
Frequently asked questions
Has Ownbit had a security audit?
Not a paid commercial audit, and none is planned. Instead: years of mature production use, AI-assisted security reviews of the MultiSig contracts by GPT-6-Astra and Opus 5 (reports published on the trust page), and open-source code you can review yourself.
Is Ownbit open source?
Since 5.0, the iOS app's key-handling code — mnemonic generation, key storage, key derivation and signing — and the JavaScript signing bundles both apps load are open source (MIT) at github.com/bitbill/ownbit-app-50; the Android core is to follow. The on-chain MultiSig contracts are public too. The user interface and the server-communication code remain closed.
Why not just get a CertiK or SlowMist audit?
We'd rather put budget and attention into an architecture you can verify yourself than into a paid certificate. We don't claim any third-party audit.
Last updated:
Download Ownbit
Install the app, then set up a cold wallet or MultiSig for the setup you need.