Platform · Security
That sentence is the entire design brief. Everything below — the cryptography, the facilities, the people, the audits — exists to keep it true.
Design principle
A custodian does one thing: it holds keys and refuses to misuse them. So we did not build a trading product and bolt security on. We built a control system and put a custody product on top of it.
The organizing rule is the elimination of single points of compromise. A stolen laptop cannot sign. A coerced employee cannot sign. A breached data center cannot sign. Moving funds at holdway requires independent people, on independent hardware, in independent locations, agreeing that a withdrawal matches the policy the client wrote — and every one of those agreements is logged to the immutable trail described on Reporting.
The same rule governs what happens if holdway itself fails. Assets sit in bankruptcy-remote, per-client segregated wallets — the structure is detailed on Custody — so a compromise of our business is not a compromise of your assets.
Key management
Keys are generated in a multi-party computation (MPC) ceremony: independent hardware-isolated signing nodes each produce a key shard, and the shards are combined mathematically to define the wallet — without the full key ever being assembled on any device, at any moment, including generation. There is no master key to steal, back up, or subpoena.
Signing works the same way. Each node computes a partial signature over the approved transaction; the partials combine into a valid signature while every shard stays inside its own hardware boundary.
The policy engine
Cryptography decides who can sign. Policy decides who may. Each client account carries a policy the client configures at onboarding and can tighten at any time:
The engine evaluates every rule before the MPC nodes are asked for a single partial signature. A withdrawal that fails any check never reaches key material. Loosening a policy is deliberately slower than tightening one.
Operational security
Most custody losses in this industry were not broken cryptography. They were people and process. We treat our own staff as part of the threat model.
Assurance
Claims on a security page are worth what a third party will attest to. Our control environment is examined on a standing schedule:
The SOC 2 report and current penetration-test summaries are available to clients and prospects under NDA through the due-diligence process on Compliance. What the architecture cannot prevent is transferred, not absorbed — coverage is described on Insurance.
Responsible disclosure
We would rather hear about a weakness from a researcher than read about it in an incident report. If something in a holdway system looks exploitable to you, write to security@holdway.xyz with enough detail to reproduce the issue.
We acknowledge every report within one business day, keep you informed as we investigate, and credit researchers who want credit once a fix has shipped.