Astra is non-custodial and built on Coinbase's infrastructure. Here is exactly how your Bitcoin is secured, what Astra can and cannot do, and what happens if anything goes wrong.
The cryptographic keys to your wallet are held and protected by Coinbase's key infrastructure, not by Astra. Astra never sees or stores your private keys.
Astra has no ability to sign for, move, sell, or withdraw the Bitcoin in your wallet. We are a bridge to your Bitcoin, never a gatekeeper of it.
Astra's requests to move funds from an employee wallet are refused by Coinbase at the signing layer, so they never even reach the blockchain. And because your holdings live on a public blockchain, you can verify your own wallet and balance anytime on any Base explorer.
Your Bitcoin lives in your own Coinbase wallet, not inside any Astra system. If Astra disappeared tomorrow, you would still reach your Bitcoin directly through Coinbase, and your wallet address is public and verifiable on the blockchain. Nothing about your ownership relies on Astra continuing to exist.
See your wallet address, balance, and public transaction history, so it can show you your dashboard, track your cost basis, and produce your records. This access is read-only.
Move, sell, or withdraw the Bitcoin in your wallet. Your keys are yours, and you alone control your funds.
Custody, key management, identity verification, and regulatory compliance all run on Coinbase, one of the most scrutinized and regulated names in crypto. That is deliberate: we did not reinvent custody, we built on the best.
Coinbase performs identity verification. Astra does not run its own, and it never asks for or stores your Social Security number to get started.
You accumulate cbBTC, a Coinbase asset backed 1:1 by Bitcoin and redeemable for it. That means part of your security rests on Coinbase honoring that backing, a real reliance we name plainly rather than hide. You can convert to native Bitcoin, through Coinbase, and hold it in your own wallet whenever you choose.
Traffic is encrypted in transit (TLS with strict transport security), data is encrypted at rest, and secrets are held in a hardware-backed key vault.
Tightly scoped database roles and per-employer data isolation (row-level security) mean one company's data is walled off from another's.
Employees and admins log in with single-use secure links; staff use enterprise SSO. There are no passwords to steal.
Astra stores only your email, your employer's payroll ID, your wallet address, plus standard sign-in security logs. No SSN, no home address, and no private keys, ever.
By design, employer dollars are pre-funded in a For-Benefit-Of account, and a double-entry ledger reconciles against the real balance daily, with any mismatch freezing operations.
Your holdings live on a public blockchain. You never have to take our word for your balance, you can verify it yourself, on-chain.
Astra has completed an internal security review, follows hardened infrastructure and supply-chain practices, and operates its own Own Your Compliance program. The custody and key-management layer relies on Coinbase Developer Platform's audited controls, so SOC 2 assurance for custody sits with Coinbase. Astra is not independently SOC 2 certified and has not commissioned a third-party penetration test. We would rather tell you that plainly than imply a certification we do not hold.
We are happy to walk your security or finance team through the details.
Request More Info