Security
Built to be
examined.
The complete control inventory, on one page, written for the reader whose job is to say no. Every control here is enforced in code, and nothing here is aspiration.
One movement, request to broadcast
01
Request
Checked against a named permission, in one workspace
02
Policy
Spending limit applies before the transaction is built
03
Signing
Your hardware, one signature at a time
04
Quorum
Held until the M-of-N threshold is met
05
Broadcast
Bitcoin rejects a witness that falls short
Not ours to override
The quorum is in
the script.
Most platforms check your approval rules in their own code. Ours are written into the Bitcoin script that locks the coins, so the network enforces them whether or not our servers agree.
Vault descriptor, two of three
wsh(multi(2,xpub…,xpub…,xpub…))
- Script type
- P2WSH
- Signatures required
- 2 of 3
- Witness
- OP_0, sigs, script
01 / Built
M goes into the script
Registering your signers generates one descriptor from their public keys. The threshold is a character inside that string, so it travels with the address rather than sitting in a database column someone could edit.
02 / Rejected
Bitcoin does the refusing
A witness holding fewer than the required signatures fails OP_CHECKMULTISIG and the network rejects the transaction. Signatures are pushed in the order their keys appear in the script, because the opcode walks both lists left to right and an out-of-order signature fails too.
03 / Finalized
Assembly waits for the count
Partial signatures accumulate until the collected count reaches M. Only then is the final witness assembled, in the same Rust crate that builds every script we produce, and only a finalized transaction is allowed to broadcast.
Every control,
named.
Nine places a request is stopped between someone asking and Bitcoin accepting. Each one is a mechanism in the stack, not a paragraph in a policy.
We cannot sign for you
There is no private key or seed anywhere in our systems, and no column to put one in. We hold public keys, xpubs, and fingerprints. A full compromise of our infrastructure still produces no signature.
Signing happens on your hardware
Trezor is integrated in the app, and every transaction moves as a standard BIP-174 PSBT carrying the derivation metadata a signer needs. The device shows what it is approving on its own screen, and registering a key aborts unless the address the device displays matches the one derived locally.
No side door around the quorum
A plain Bitcoin send is refused on any governance vault; it exists only for personal wallets. A vault movement is a PSBT that collects signatures until the threshold is met, and only a finalized transaction is allowed to broadcast.
The signing service has no public endpoint
The key coordination service is internal only. The outside world reaches it through one gateway, where every request is authenticated and checked against a named permission before anything is built or signed.
Nothing can be quietly deleted
Sign-ins, permission changes, every partial signature, and every broadcast are written once and never edited. A malformed event is quarantined to its own table rather than dropped, and reads come back in one fixed order. 36 event types across 8 categories.
Your auditors serve themselves
The audit team filters the log by category and date in the app and exports the CSV behind its own permission. The export lands in the log too, requested, completed, or failed, so even looking is on the record.
Access follows your org chart
Eleven named permissions, granted per role and checked at every endpoint against the workspace in the request. Nothing crosses between workspaces, and there is no global administrator who can see everything.
Limits that fail closed
Per-role and per-vault spending limits on weekly or monthly cycles, checked before a token transfer's transaction exists. A vault with no policy attached refuses by default rather than waving the request through.
Sign-in you already control
Your own identity provider over OIDC, or email with a one-time code. Sessions created, revoked, and expired are audited events, so who had access and when is a query rather than a question.
The scope, as data.
What we run, what we store, and what we refuse to hold. If your review needs more than this page, we will walk your team through the model against your own checklist.
- Networks
- Bitcoin mainnet and testnet
- Vault script
- P2WSH, M-of-N multisig
- Transaction standard
- BIP-174 PSBT
- Hardware signing
- Trezor, verified on device
- Identity
- OIDC SSO or one-time code
- Key material stored
- Public keys and xpubs only
