Solution Architecture
This page provides a high-level view of The Vault’s architecture — the key domains, how they interact, and the security boundaries between them.
This is an architectural overview for understanding the platform’s design principles. For integration details, see the API Reference.
Architecture Principles
| Principle | Implementation |
|---|---|
| Defense in depth | Multiple independent security layers (TLS, mTLS, E2E encryption, hardware TEE) |
| Zero trust | Every component authenticates and authorizes every request, regardless of network location |
| Separation of concerns | Key material is isolated from business logic; signing infrastructure is independent from the application layer |
| No single point of compromise | MPC threshold scheme ensures no single component holds a complete private key |
Domain Overview
The platform is organized into five architectural layers:
Domain Descriptions
Client Layer
| Client | Purpose |
|---|---|
| Web Dashboard | Full-featured administration interface for wallet management, policy configuration, and user administration |
| Mobile App | Transaction approval, MPC signing participation, and push notification-based workflows |
| Server Integration (M2M) | Programmatic access via REST API for automated systems (exchanges, trading desks, treasury automation) |
Edge Layer
The edge layer enforces authentication and authorization before any request reaches backend services:
- API Gateway — TLS termination, rate limiting, IP allowlisting, request routing
- Identity-Aware Proxy (IAP) — Zero-trust enforcement: verifies identity (authentication) and permissions (authorization) on every request
- Identity Provider (IDP) — User identity lifecycle: registration, login, session management, MFA, account recovery
All traffic between the edge layer and backend services is secured with mutual TLS (mTLS).
Application Layer
| Domain | Responsibility |
|---|---|
| User & Access Management | Users, profiles, device registration, role-based access control (RBAC) |
| Wallet Management | Multi-chain wallet creation, HD key derivation, address generation, balance tracking |
| Policy Engine & Governance | Transaction policies (limits, whitelists, approval quorums), compliance workflows, multi-signature coordination |
| Notifications | Push notifications for signing requests, approvals, and security events |
| Immutable Audit Log | Tamper-evident record of all actions; append-only storage with cryptographic integrity verification |
Services communicate asynchronously via an event bus for audit trail propagation and cross-service notifications.
MPC Signing Layer
The signing layer is architecturally separated from the application layer to minimize the attack surface around key material:
- Coordinator — Orchestrates MPC protocol sessions (DKG, signing, refresh, recovery). Routes messages between parties but cannot read their contents (Noise E2E encryption).
- Server Signers — Hold key shares in persistent encrypted storage. Optionally run inside hardware TEEs (Intel TDX) for memory-level protection. Participate automatically in every signing operation.
- Mobile Signers — Hold key shares encrypted at rest in the device’s secure storage (encryption key in the OS Keychain / Keystore, hardware-backed where available). Participate on-demand via push notification, authorised with the app PIN.
The coordinator and server signers are stateful components that maintain persistent cryptographic state. High availability is achieved through the k-of-n threshold scheme (fault tolerance), not through horizontal scaling.
Blockchain Layer
Per-network indexers continuously synchronize blockchain data (blocks, transactions, balances) from full nodes. The application layer queries indexed data rather than blockchain nodes directly, enabling:
- Instant balance lookups and transaction history
- Deposit detection with configurable confirmation thresholds
- Fee estimation based on current network conditions
- Address monitoring for all registered wallet addresses
Currently supported networks: Bitcoin, Ethereum (including ERC-20 tokens), and TRON (including TRC-20 tokens).
Security Boundaries
| Boundary | Protection |
|---|---|
| External → Edge | TLS 1.3, rate limiting, IP allowlisting |
| Edge → Application | Mutual TLS (mTLS), identity verification, RBAC |
| Application → Signing | Mutual TLS (mTLS), restricted API surface |
| Signer ↔ Signer | Noise Protocol (E2E encryption), forward secrecy per operation |
| Server Signer memory | Hardware TEE (Intel TDX) — host OS cannot read key shares |
| Mobile Signer storage | Share encrypted at rest in app storage; encryption key held in the OS secure storage (hardware-backed where available) |
Cross-References
- How It Works — MPC threshold signing and k-of-n key share model
- Deployment Models — SaaS, Hybrid, On-Premises topologies
- On-Premises Installation — Deployment overview and onboarding package
- Security Overview — mTLS, Noise Protocol, TEE, threat model
- Network Security — Certificate management and network policies
- Confidential Computing — Intel TDX hardware protection for server signers