Platform · Reporting
Real-time balances, UTC-cut statements, and an append-only audit trail — every number traceable to a segregated on-chain address.
Balances & positions
Balances update as deposits confirm and transfers settle — the same figures in the dashboard, the API, and your statements, from a single ledger.
Positions are reported per asset, per storage tier, per wallet address, so your treasury
view matches the on-chain reality exactly. GET /v1/balances returns the live
position; webhooks push deposit confirmations and transfer state changes as they happen,
so your internal systems never poll and never lag. Because every balance belongs to a
segregated, per-client address, any
figure we report can be checked against a public block explorer.
Statements
Daily and monthly statements are generated at a fixed 00:00 UTC cut, so every statement in every system refers to the same instant.
Each statement covers opening and closing balances, all movements with transaction hashes,
fee detail, and the attestation reference for the period. Delivery is dashboard download,
GET /v1/statements, and scheduled SFTP drop into your own infrastructure —
in PDF for people, CSV and JSON for machines. Once finalized, a statement is never
regenerated; corrections appear as dated adjustment entries in the next period, never as
silent edits to a closed one.
Audit trail
Every action on your account — transfer initiations, approvals and rejections, policy changes, login events, API-key operations — is written to an append-only audit log the moment it happens.
Entries carry the actor, the action, the timestamp, and the affected resource, and no interface exists to edit or delete them — not for your operators, not for holdway staff. The full trail exports as CSV or JSON for any date range, formatted so it can be handed straight to auditors: your external audit firm receives raw entries they can sample and trace end to end, not a summary we prepared about ourselves. Policy changes are double-logged — the change event and the approval quorum that authorized it — as covered in our security model.
# Retrieve finalized statements for a period curl https://api.holdway.xyz/v1/statements?period=2026-Q2 \ -H "Authorization: Bearer $HOLDWAY_API_KEY" { "period": "2026-Q2", "cut": "2026-07-01T00:00:00Z", "statements": [{ "id": "stmt_9f2c81", "asset": "ETH", "closing_balance": "14208.40", "formats": ["pdf", "csv", "json"], "attestation_id": "attn_2026q2_88f2", "status": "finalized" }] }
Proof of reserves
Each attestation cycle produces a signed artifact: your segregated addresses, their balances at the cut, and signatures proving holdway controls the keys.
The artifact is published to your dashboard, retrievable by API, and pushed to your
systems through the reserves.attested webhook with the signed payload
attached. Verification requires nothing from holdway: check the signatures against the
published addresses, then read the balances from any public block explorer. Attestation
references are embedded in every statement, so any period's reported balance ties back to
an artifact anyone can re-verify years later.
reserves.attested webhook delivers the signed payload as it publishesAuditor access
You can issue your external auditors scoped, read-only credentials to your account — real access to real records, without routing everything through your team.
Auditor credentials see balances, statements, the audit trail, and attestation artifacts; they cannot initiate, approve, or configure anything. Exports made under an auditor credential can be period-locked — bound to the engagement's date range so the firm pulls exactly the fieldwork period, every time, and each pull is itself recorded in the audit trail. Access expires with the engagement.
Reconciliation
Every movement carries the detail your accounting close actually needs — tax-lot identifiers, acquisition dates, and cost-basis fields on each line.
Exports come in ERP-friendly layouts: flat CSV with stable column names for direct import into your general ledger or reconciliation tooling, and structured JSON for automated pipelines. Fee lines are broken out per transaction rather than aggregated, and every row references its transaction hash, so a reconciler can tie ledger entries to chain and back without a mapping exercise. Formats are documented field by field in the developer documentation, and our reporting controls are covered in the SOC 2 Type II report described on the compliance page.