MPC wallet,
key management
and policy engine
Three things decide whether digital assets are actually safe: where the key lives, what has to happen before it signs, and who can see what was done. This is how each one works here.
Your keys never exist in one place
Private keys are the most sensitive component of digital assets. The Vault protects them through multiple independent layers, supported across all deployment models.
Multi-party computation wallet architecture is supported across all three deployment models, SaaS, Hybrid and On-premise, with the same security guarantees at every level.
MPC Cryptography
The Vault uses true threshold MPC, a T-of-N signature scheme where each private key is split into shares distributed across client devices and TEE-secured servers. The key is never assembled in full at any single point, eliminating the risk of theft even in the event of a breach.
TEE Technology
Trusted Execution Environment (TEE) provides hardware-level isolation for key operations. Even if the surrounding server infrastructure is compromised, operations inside the TEE remain protected, and key shares cannot be extracted.
Your Sole Control
Private keys are generated and stored within the client’s own perimeter. The Vault infrastructure never has unilateral access to keys or the ability to sign transactions without client authorisation.
A policy engine that governs every fund movement
Structural governance enforced before any key share activates. Nothing reaches the signing step that the policy has not already allowed.
- 01 Approval policies Who has to sign off, and in what order.
- 02 Spending limits Ceilings per wallet, per period and per operation type.
- 03 Address whitelists Where funds are allowed to go at all.
- 04 Enterprise policy engine Rules applied across the whole organisation, not per wallet.
- 05 Role-based permissions What each role may initiate, approve or only observe.
- 06 Flexible rule configuration Conditions and quorums set to your own operating model.
Step-by-step:
how every transaction is governed
A multi-user wallet only delivers security if the approval process is strictly enforced.
- 01
Policy Setup
Admins configure rules, limits, and quorums.
- 02
Initiation
Authorised user creates a request. Initiators cannot approve.
- 03
Validation
Auto-check against predefined rules. Non-compliant requests are instantly rejected.
- 04
Approval
Routed to designated approvers based on policy quorum.
- 05
Signing
MPC key shares sign across devices and TEE servers.
- 06
Execution
Submitted to the blockchain.
Complete visibility across every wallet and operation
Audit-ready architecture with deep operational visibility built for regulated environments.
- Comprehensive audit trail Every operation captures initiator, approvers, timestamps, and device identifiers.
- End-to-end monitoring Full visibility across all wallets for compliance and finance teams.
- Cryptographic integrity Tamper-resistant databases ensure audit logs cannot be altered retroactively.
- Complete attribution Nothing is anonymous. Every decision is tracked to a specific user & device.
- Initiator
- Authorised user · role: Treasury Ops
- Approvers
- 3 of 4 required, quorum met
- Policy applied
- Version in force at the time of the request
- Devices
- Each key share signed on its own device
- Timestamps
- Requested, approved, signed, submitted
Illustrative record. Logs are tamper-resistant, so an entry cannot be altered after the fact.