Security
Security is a foundational property of The Vault, not an add-on. This section documents the security architecture, key management model, network controls, and threat analysis that underpin the platform.
Security Principles
The Vault is designed around four core security principles:
No single point of key compromise — The configurable MPC threshold (default 3-of-4) ensures that compromising any single component (a server, a device, a credential) is insufficient to access funds. An attacker must simultaneously control the required quorum of key share holders.
Human-in-the-loop — For any wallet with enrolled mobile signers, every transaction requires a human on a registered mobile device to confirm signing: the signing quorum always reserves a mobile signer slot, so the servers cannot sign on their own. (A policy may additionally require governance approvals — a separate step — beforehand.) The sole exception is a deliberately-created server-only wallet, an opt-in automation type with no mobile devices.
Zero-trust networking — No component trusts another by default. All service-to-service communication requires mutual TLS with verified certificates. No implicit trust is granted based on network location.
Audit and non-repudiation — Every action is logged immutably. Cryptographic signing of audit events ensures that the record of what happened cannot be altered after the fact.
The Vault has been designed in alignment with the STRIDE and MITRE ATT&CK threat-modeling frameworks. A detailed threat model is maintained internally and available to customers under NDA.
Security Architecture Overview
| Layer | Control |
|---|---|
| Key Management | Configurable k-of-n MPC threshold ECDSA (default 3-of-4) using audited threshold cryptography |
| Key Share Storage | Server signers: TEE-sealed (hardware-attested). Mobile signers: encrypted at rest in app storage, encryption key held in the OS secure storage |
| Confidential Computing | Hardware TEE (Intel TDX) for server signers with remote attestation before secret delivery |
| Authentication | Password + mandatory second factor (one-time email code by default, or TOTP); session and API key support |
| Authorisation | Role-Based Access Control enforced on every request |
| Transport Security | Mutual TLS on all internal service communication |
| API Security | Identity-Aware Proxy; JWT/API key validation; rate limiting at the edge |
| Device Security | X.509 device certificate binding; lost devices are blocked (logout + exclusion from signing) |
| Audit Trail | Append-only, hash-chained audit log with WORM archival |
| Network Segmentation | Network policies and zero-trust enforcement between services |