Treasury & Custody
If reaching cold storage is convenient, it is not cold storage
Custody is a set of deliberate inconveniences. Every one of them exists because somebody, somewhere, removed it and found out why it was there.
Enough to service normal outbound flow and no more. Automated signing lives here, which is exactly why the amount it can reach is capped rather than convenient.
Requires human approval to move, but the people who can approve are available during business hours. Refills the hot tier when it depletes.
Offline, hardware-backed, multiple parties required and deliberately slow to access. If reaching it is convenient, it is not doing its job.
See it live
Approval, biometrics, and the device it happened on
Multi-party sign-off is not just a policy here — it is a screen a second approver actually sees before a movement above threshold goes anywhere.
Four disciplines
Each of these is enforced, not merely expected
No single person can move funds
Above a threshold you set, movement requires more than one party, and the same person cannot both request and approve. This is a policy configuration rather than a procedure people are asked to follow.
Keys are hardware-backed
Signing material is held in hardware rather than in a file or an environment variable. Extraction is not part of the normal operating model, which changes what a compromised server actually gets you.
Recovery is rehearsed
A recovery procedure that has been written but never performed is a document, not a capability. It is exercised on a schedule, and the exercise is what reveals the step somebody forgot to document.
Every action is attributable
Who initiated, who approved, from where, and against which policy. Not for the routine case, but for the one time somebody needs to reconstruct exactly what happened and when.
FAQ
Custody and keys: common questions
6 short answers to what teams ask before a demo.
Only enough to service normal outbound flow, with a cap you set. The hot tier is where automated signing happens, so the right question is not how much is convenient but how much you would accept losing in the worst case.
Not above the threshold you configure, and the same person cannot both request and approve a movement. This is enforced by the platform rather than being a procedure people are trusted to follow.
In hardware, not in a file or an environment variable. That distinction is what determines whether a compromised server results in an inconvenience or a loss.
It is exercised on a schedule, which is the only way to know it works. Running it is also what surfaces the undocumented step — there is almost always one, and finding it during a real incident is expensive.
That is a commercial and regulatory decision, and both arrangements exist. What does not change is that the control model, the approval thresholds and the audit record are explicit and agreed in writing before anything goes live.
The control model, evidence that multi-party approval is enforced rather than intended, the recovery test record, and an attributable log of movements over a period. All four are producible without a project.
Still have a question?
A specialist will answer it directly, with your set-up in mind.
Ask a specialistWhen was your recovery procedure last performed?
Not written, not reviewed — performed. It is the single most useful question to ask about any custody arrangement, including ours.