Security model
Security, stated plainly.
Five layers, each designed so that the failure of one never puts client assets at risk. Open any layer for the detail.
The five layers
Key shares live in hardware security modules in separate facilities operated by separate teams. No facility holds enough to sign.
- Geographically separated sites
- Tamper-evident hardware
- No shared administrators
Signing is a joint computation between shares. The complete private key is never assembled, so there is no moment at which it can be copied.
- Threshold signatures
- Key never reconstructed
- Share rotation without moving funds
Every transaction is checked against your institution's rules before signing begins: quorums, limits, allow-lists and time locks.
- Quorum approvals
- Velocity and value limits
- Counterparty allow-lists
People are a layer too. Access is role-based, sensitive actions need two people, and every action is recorded in an append-only log.
- Four-eyes on sensitive actions
- Hardware-key sign-in
- Append-only audit log
Controls are tested by outside auditors and penetration testers, and summaries of their findings are available to clients under NDA.
- External control audits
- Regular penetration testing
- Client access to reports
Key ceremony
How a vault comes into being.
Every client vault begins with a witnessed ceremony, recorded and signed.
- Step 01
Prepare
Hardware is inspected and sealed. Participants are verified in person.
- Step 02
Generate
Key shares are created inside each module. None is ever exported.
- Step 03
Distribute
Shares are bound to their sites. Backups are sealed under dual control.
- Step 04
Attest
The ceremony record is signed by every participant and an observer.
Questions
What auditors ask first.
Can Northvault staff move client assets?
No single person can. Movements require your institution's own quorum of approvers, and the platform's operators cannot approve on your behalf.
What happens if a facility goes offline?
The signing threshold is set so that the loss of any one site does not stop operations or put assets at risk.
Are client assets segregated?
Yes. Each client's assets sit in accounts held for that client alone and are never pooled with Northvault's own funds.
Can we see the audit reports?
Clients and prospective clients can review summaries of audit and penetration-test findings under a non-disclosure agreement.