Platform · Security

No single person, device, or location can move funds.

That sentence is the entire design brief. Everything below — the cryptography, the facilities, the people, the audits — exists to keep it true.

Design principle

Security is the product.

A custodian does one thing: it holds keys and refuses to misuse them. So we did not build a trading product and bolt security on. We built a control system and put a custody product on top of it.

The organizing rule is the elimination of single points of compromise. A stolen laptop cannot sign. A coerced employee cannot sign. A breached data center cannot sign. Moving funds at holdway requires independent people, on independent hardware, in independent locations, agreeing that a withdrawal matches the policy the client wrote — and every one of those agreements is logged to the immutable trail described on Reporting.

The same rule governs what happens if holdway itself fails. Assets sit in bankruptcy-remote, per-client segregated wallets — the structure is detailed on Custody — so a compromise of our business is not a compromise of your assets.

Key management

A complete private key never exists. Anywhere.

Keys are generated in a multi-party computation (MPC) ceremony: independent hardware-isolated signing nodes each produce a key shard, and the shards are combined mathematically to define the wallet — without the full key ever being assembled on any device, at any moment, including generation. There is no master key to steal, back up, or subpoena.

Signing works the same way. Each node computes a partial signature over the approved transaction; the partials combine into a valid signature while every shard stays inside its own hardware boundary.

  • Ceremony-generated shards — created inside hardware isolation, never exported in plaintext, never on a general-purpose machine
  • Geographic separation — shards distributed across hardened facilities in separate regions, so no site visit, seizure, or disaster reaches a signing threshold
  • Hardware isolation — signing nodes are dedicated, access-controlled devices with no route to the public internet from key material
  • Shard rotation and re-sharing — shards are proactively re-shared on a fixed schedule and on personnel or facility change, invalidating old shards without moving funds or changing addresses
  • Cold by default — deep cold storage for reserves; only operational balances sit in the warm tier, behind the same policy engine

The policy engine

Every withdrawal argues its case before anything signs.

Cryptography decides who can sign. Policy decides who may. Each client account carries a policy the client configures at onboarding and can tighten at any time:

  • Approval quorums — e.g. 3-of-5 named approvers, with distinct quorums per amount band
  • Allow-listed destinations — transfers settle only to pre-registered addresses; adding one is itself a quorum event with a waiting period
  • Time-locks — a mandatory delay between final approval and broadcast, long enough to cancel a coerced or mistaken instruction
  • Velocity limits — caps on value moved per day and per week, so even a fully approved compromise is bounded

The engine evaluates every rule before the MPC nodes are asked for a single partial signature. A withdrawal that fails any check never reaches key material. Loosening a policy is deliberately slower than tightening one.

holdway · policy engine — withdrawal #4188
Instruction received
120.00 ETH · via API, mTLS + signed payload
Verified
Destination check
Address on client allow-list since 2026-03-11
Pass
Quorum 3-of-5
Approvals: Treasury Ops ×2 · CFO ×1
3 / 3
Velocity limit
Day total 8.4% of cap after this transfer
Within cap
Time-lock
Broadcast eligible 14:00 UTC · cancellable until then
Holding
MPC signing
Awaiting time-lock release
Queued

Operational security

The controls extend to the humans.

Most custody losses in this industry were not broken cryptography. They were people and process. We treat our own staff as part of the threat model.

  • Personnel vetting — background checks before hire and periodic re-screening for every role with access to production systems or facilities
  • Dual control — no sensitive operation (shard ceremonies, policy changes, production deploys) is executable by one person acting alone
  • Segregation of duties — the people who build the platform, operate the keys, and approve client policy changes are different people with non-overlapping credentials
  • 24/7 monitoring — a staffed operations function watches signing activity, facility access, and on-chain flows, with anomaly detection that pages a human for anything outside a client's normal pattern

Assurance

Do not take our word for any of this.

Claims on a security page are worth what a third party will attest to. Our control environment is examined on a standing schedule:

  • SOC 2 Type II — an annual examination of the controls on this page as they operated over the period, not a point-in-time snapshot
  • Independent penetration tests — twice a year, by external firms, against the platform, the API, and the signing infrastructure, with findings tracked to remediation
  • Continuous monitoring — automated control checks between audits, so drift is caught in days rather than at the next annual review

The SOC 2 report and current penetration-test summaries are available to clients and prospects under NDA through the due-diligence process on Compliance. What the architecture cannot prevent is transferred, not absorbed — coverage is described on Insurance.

holdway · assurance calendar
SOC 2 Type II
Annual · independent audit firm
Current
Penetration test — platform & API
External firm · H1 2026
Complete
Penetration test — signing infrastructure
External firm · H2 2026
Scheduled
Control monitoring
Automated checks between audits
Continuous

Responsible disclosure

Found something? Tell us.

We would rather hear about a weakness from a researcher than read about it in an incident report. If something in a holdway system looks exploitable to you, write to security@holdway.xyz with enough detail to reproduce the issue.

We acknowledge every report within one business day, keep you informed as we investigate, and credit researchers who want credit once a fix has shipped.

  • Safe harbor — good-faith research within these terms will not be met with legal action
  • Stay in bounds — do not access, modify, or exfiltrate client data; use test accounts and stop at proof of concept
  • Give us time — allow a reasonable window for remediation before any public disclosure; we will agree on a timeline with you

Bring your security team. Especially the skeptical one.