Key Management Run any key anywhere, from one platform. Store keys in MPC, HSM, or offline.<br /> Run them in our cloud, yours, or on your metal.
Generate your keys with advanced multi-party computation. The key never exists in full.
No mnemonic, no recovery sheet, no HD tree rooted in a single secret an attacker can target.
Each share derives from its enclave's hardware RNG. No shared seed, no correlated randomness.
secp256k1, Ed25519, Stark, Schnorr, covered by KU25 for ECDSA and FROST for Schnorr.
Before any key share participates, the request must be user-signed, policy-cleared, and cryptographically authorized. Compromise one layer and nothing signs.
Quorums, limits, and allowlists are evaluated before a signature exists, not after it settles.
Passkeys authenticate the request; MPC keys authorize the action onchain. They are different.
Sensitive requests carry a WebAuthn signature from the user's device, bound to the exact action.
Key shares span multiple regions. Signer quorums remain available when nodes fail. No whole key exists to rotate, expire, or lose.
MPC doesn't depend on freshness. Rotate the credentials that touch it; leave the key in place.
A region can go dark, the signing quorum carries on. Continent-level failures degrade gracefully.
The threshold tolerates losing nodes and missing shares by reconstituting them under attestation.
Run company wallets and user wallets on the same key management layer. Custody what you hold. Delegate what they hold.
Hold keys for your users. Or delegate signing so they approve, you operate per wallet.
Add user wallets inside your product with a passkey. No seed phrase to manage.
However the key is held, every signature lands in the same signed, timestamped record.
Discover how Zodia Custody secures keys on DFNS.
Thanks to their collaborative team and institutional-grade wallet platform, we've enhanced our operational capabilities and widened our business lines. Our security framework has also been reinforced by their state-of-the-art MPC cryptography.
Three archetypes. Three configurations. One platform.
Air-gapped Offline Signers in a sovereign data center. HSM inside the country’s borders. Every key generation witnessed as a ceremony. Every signature is a four-of-seven quorum.
See our deployment optionsHextrust runs sub-organizations per client and per jurisdiction. Hybrid deployment matches controls to asset class — SaaS for new chains, on-prem for the assets that demand it.
Discover our integrationsDue provisions non-custodial wallets for tens of thousands of users through DFNS. Passkeys on the user’s device. Co-controlled signing with the neobank’s policy engine.
Read the Due storyMPC or HSM. Mix them by wallet, entity, or mandate. Our key layer adapts to your risk model.
Managed SaaS, hybrid, or fully on-premises. Same API, same controls, wherever the keys live.
MPC across enclaves, no seed phrases. The key is never assembled and signing never stops.
A single key derives wallets on 100+ networks. Manage access once, apply it everywhere.
MPC for distributed keys. HSM-backed when you want hardware. The rest of the flow is identical whichever you pick.
Reference the same keyId to derive wallets on any compatible network. Same address on every EVM chain.
Passkeys and credentials authenticate the request. The key authorizes the signature. Compromise one and the other still holds.
Managed SaaS for ease. Hybrid cloud when regulation requires it. On-premises when sovereignty matters.
Manage your consent by category. Strictly necessary cookies are always active. See our Cookie Policy for details.
Required for core features and security. These cannot be switched off.
Remember choices such as language or region to enhance the site.
Help us understand how the site is used so we can improve it.
Measure campaigns and deliver content relevant to you.