Security built for real custody
Every layer, from key generation to transaction signing, is designed so Trustodian never has enough on its own to move your funds. What follows is the security a user actually configures, sees, and relies on. Infrastructure and deployment controls live in the engineering security document.
Every sign-in and every sensitive action is verified, freshly
Passkeys, 2FA, and biometrics don't just gate the front door. Every high-value action (signing a transaction, exporting a key, adding an address, changing settings) triggers its own challenge with no session bypass. A stolen tab or an unattended device is never a green light.
Passkeys (FIDO2 / WebAuthn)
Sign in and authorize actions with Face ID, Touch ID, Windows Hello, or Android biometrics. Passkeys sync via the user's OS ecosystem (iCloud Keychain, Google Password Manager) and stay device-bound at the OS level.
Detail
Phishing-resistant, no shared secret to steal
Two-Factor Authentication (2FA)
TOTP via any authenticator app (Google Authenticator, Authy, 1Password). Required before a passkey can be enrolled, so 2FA is always the fallback if biometrics fail or a device isn't available.
Detail
Works as a native fallback when passkey isn't at hand
Per-action verification
Sending a transaction, signing a vault approval, exporting a private key, adding a whitelisted address, generating an API key: each triggers a fresh biometric/passkey/2FA check. Sessions never grant blanket approval.
Detail
20+ user actions gated individually
Cross-device verification via QR
When you're on a browser or device where your passkey isn't enrolled, Trustodian shows a QR code. Scan it with your registered phone to complete the challenge over Bluetooth proximity, so there is no locked-out state.
Detail
Native WebAuthn CTAP2 flow
The keys are yours, generated on your device, never stored in plaintext by us
Trustodian is non-custodial in the strict sense: your private keys are generated on your device and are never transmitted to any Trustodian server in usable form. The platform stores encrypted shares only, and the keys used to decrypt them are derived from a secret only you know.
BIP-39 recovery phrase
12- or 24-word recovery phrase generated at registration or imported from an existing wallet. The same phrase covers Bitcoin, EVM, Solana, Tron, XRP, and Cardano: one phrase to back up everything.
Detail
Standard BIP-39, restores in any compatible wallet
Optional passphrase (25th word)
Add a second secret at setup that no one at Trustodian and no support agent can ever see. The passphrase silently derives a completely different wallet set, so a recovery phrase alone won't reach your funds.
Detail
Standard BIP-39 passphrase, recognised by hardware wallets
Wallet Password (separate from login)
Distinct from the account login password. Used to derive the keys that decrypt your encrypted shares, never transmitted to the server. Change it any time; every active signing session is invalidated on change.
Detail
Session terminated on password change
Wallet Password Backup
At setup you save an encrypted backup of your Wallet Password. If you forget it, this backup is the only way to reset. Trustodian keeps no copy; you download or copy the backup yourself and store it wherever you like.
Detail
Kept by you, not by us
Quorum is enforced by the blockchain, not by Trustodian's server
Every vault runs on its chain's native multisig: Bitcoin scripts, Safe on EVM, Squads on Solana, native SignerList on XRP. That means the quorum rule is a property of the on-chain address itself. Even if Trustodian went away, the vault would still only move on the same M-of-N.
Custom M-of-N quorum
Any threshold up to 10 signers per vault. 2-of-3 for personal escrow, 3-of-5 for treasuries, 4-of-7 for institutions. Each signer holds an independent private key: no shared secret, no distributed-key coordinator.
Detail
Signers can be users, other wallets, or hardware devices
On-chain enforcement
The chain itself decides whether the required signatures are present. Trustodian's servers never sit between quorum and execution. Once the last signature is added, the network broadcasts and settles the transaction.
Detail
Verifiable on any block explorer
Signer rotation
Add, replace, or remove signers on EVM (via Safe), Solana (via Squads), and Tron. Rotation is itself a multisig transaction; the current quorum must sign off. Bitcoin and Cardano multisig signer sets are immutable by protocol.
Detail
Rotation itself requires quorum approval
Independent audit trail
Every vault action is on-chain: the transaction, the signatures, the address of every signer, and the block that included it. You don't need to trust Trustodian's records; the blockchain has them too.
Detail
Trustodian's audit log and the chain are cross-checkable
Set the rules once. Trustodian enforces them on every payment
Whether the sender is you, an employee, an API key, or an AI agent, every transaction is evaluated against the same policy engine before it can broadcast. Limits, whitelists, and business hours are applied identically across the UI, the SDK, and the x402 automated-payments flow.
Address Book & whitelisting
Save trusted recipients with a name and chain type. Enable Force Address Book mode on an organization and the destination field becomes a strict dropdown: manual pasting is disabled, only whitelisted addresses can receive.
Detail
FATF Travel Rule fields captured per entry
Per-transaction, daily, monthly limits
Cap the maximum size of a single payment, and the total that can move in 24 hours and in a calendar month. Limits reset automatically at 00:00 UTC daily and on the first of each month, with no manual roll-over.
Detail
Applied at organization tier, then per API key
Business hours
Define an operating window and a timezone. Transactions outside business hours are blocked at policy-check time (not queued, not silently delayed) with a clear rejection reason so the caller knows why.
Detail
Explicit rejection: 'Outside of permitted business hours'
KYT & sanctions screening
Every payment is screened against sanctions lists and KYT feeds before it's broadcast. A sanctions match blocks the transaction entirely; a high-risk score can be routed to manual review depending on organization settings.
Detail
Applies regardless of amount or execution path
A signing session is short, per-device, and revocable
Cached authorization is one of the most abused surfaces in wallet UX: 'unlocked' for hours, transactions signed on autopilot. Trustodian caches the minimum required to avoid re-typing your password on every keystroke, and no more. Every trigger that could hint at abandonment invalidates the session.
1-hour signing session
After a fresh authentication, transactions signed within the next hour don't re-prompt for the wallet password. After that, or on any trigger below, the session is over and a new authentication is required.
Detail
Cached data is the derived key only, never the password
Auto-lock triggers
Logout, tab or window close, app backgrounded on mobile, and browser-extension service worker restart all invalidate the session immediately. There's no persistent 'stay signed in' toggle to override this.
Detail
Explicit re-authentication after any trigger
Per-device passkey list
Every passkey is enrolled per-device with an auto-derived label (e.g. 'iPhone 15 / Safari'). Review the full list in Security settings. Remove any entry to instantly revoke that device's ability to sign.
Detail
Lost or sold a device? One click removes it
Lockout on repeated failures
Three consecutive failed authentications trigger a 5-minute cool-down. Continued failures force a sign-out. Applies to wallet-password re-entry, 2FA, and passkey, so there is no brute-force endpoint.
Detail
Same rate limit applies to 2FA fallback and recovery-phrase entry
Every automation is scoped, whitelisted, and revocable
The same underlying policies that gate manual transactions apply to API keys. A key never grants more than exactly what was checked at creation, and the key itself is bound to a specific wallet or vault on a specific network, with no lateral access.
Per-key granular permissions
Seven separate scopes: view balances, view transaction history, create wallet, create vault, initiate transfer, initiate withdrawal, update vault settings. A key without a scope for an endpoint gets a hard 403.
Detail
New scopes for Travel Rule and org management in V3
Optional IP whitelist per key
Restrict a key to specific IPs. A request from an address not on the list is rejected; the key never even reaches the endpoint's business logic. IPs can be edited any time from the API Management screen.
Detail
Zero-IP-list keys work from anywhere; add IPs to tighten scope
One-time key display
The secret is shown once at creation, then masked forever. You can reveal it again only through a fresh 2FA or passkey challenge if either is configured: no hint, no partial reveal, no server-side copy.
Detail
Deactivate or delete a key any time; takes effect immediately
Instant revocation
Revoked keys are rejected on the next request they make, with no propagation delay. Deletion is permanent. x402 automated-payment keys stop accepting payment requests the moment a key is revoked or its wallet is deleted.
Detail
Revocation reflected in the audit log with actor and timestamp
Everything is logged, exportable, and cross-checkable against the chain
Compliance teams and forensic investigators alike need one thing above all else: evidence. Trustodian records every user action with the context needed to reconstruct it, exports it in a format their tooling can ingest, and lets them cross-check the sensitive parts on the blockchain.
Comprehensive audit log
Every account action is recorded: sign-ins, wallet creation, vault operations, policy changes, API key use, passkey enrollment. Each entry captures actor, action type, target, timestamp, IP address, device, and result.
Detail
Visible in Settings → Audit Logs, filterable by date and type
CSV export
Export the audit log filtered by date range and event type. The download contains the exact rows shown on screen (the same filter, no more, no less) for direct import into Excel, GRC platforms, or a SIEM.
Detail
Pagination doesn't limit the exported set
On-chain verifiability
Every vault transaction (the amount, the recipient, the signers, the block it settled in) is on the chain the funds live on. The audit log and the blockchain agree, and either can be verified against the other.
Detail
Block-explorer links surface alongside every executed vault tx
Screening results are logged too
KYT and sanctions results are recorded alongside the transaction they belong to, including matches, near-matches sent to review, and the sanctions provider's response code. Blocked transactions leave a full paper trail.
Detail
Required for audit-ready anti-money-laundering evidence
Locked out isn't lost, and deletion is deliberate, not accidental
A non-custodial wallet lives and dies by the quality of its recovery flows. Trustodian gives you four independent paths back in, and separates account deletion from key deletion so no one can accidentally destroy funds while trying to close an account.
Restore access with recovery phrase
Enter your recovery phrase on a new device to regain wallet access. Set a new wallet password on the spot. The previous Wallet Password Backup is invalidated so a copy someone else has can't be used against you.
Detail
Also unlocks archived phrases from earlier resets
Wallet Password Backup path
Forgot the wallet password but still hold the backup? Enter the backup, prove ownership, and set a new password. Fails if the backup doesn't belong to the account. Trustodian never has an override; this is the only path.
Detail
5 wrong-backup attempts trigger a 15-minute cool-down
Recovery phrase reset (last resort)
No password, no backup, no copy of the phrase? Reset via a single-use email link. The old phrase is removed from the platform; its wallets become read-only. Enter the phrase later and everything unlocks; the archive is permanent.
Detail
30-day recovery window before finalization
Account deletion with 30-day grace
Deletion never happens in one click. Consequences are disclosed, identity is re-verified, and you type your account email to confirm. The account then enters a 30-day pending state, cancellable from the app or the confirmation email.
Detail
Meets Apple App Store and Google Play in-app deletion policy
Scope note
Infrastructure security is out of scope here, on purpose
This page covers what a Trustodian user configures, sees, or relies on. It doesn't cover how the platform is deployed: HashiCorp Vault Transit for server-side encryption, Cloudflare Worker OPRF for password-derived key material, PostgreSQL isolation, CI/CD secret rotation, rate-limiting infrastructure, and TLS termination are all real and all layered under everything above. Those controls change without a customer needing to hear about it, so they live in the engineering security documentation rather than here.
One security model, every wallet, every vault
The same controls apply whether you hold one BTC wallet or a fleet of institutional vaults
Individuals get the same passkey flow, the same phrase model, and the same audit log as an institutional client. What scales is the policy layer (organization limits, address whitelisting, business hours, force-KYC), not the foundational security.