FOR PRODUCT, RISK AND ENGINEERING
Make an informed custody decision.
Understand the architecture, the responsibilities and the path to production before your first workshop.
What the evidence pack covers.
Review the implemented architecture and completed security work alongside the validation included in each deployment scope. Materials and engineer sandbox access are shared under NDA.
- Architecture
- Implemented architecture
Custody participants, trust boundaries and the policy-to-signing workflow.
- Independent security audit
- Completed
Scope of the completed seven-phase independent security audit.
- Independent cryptography audit
- Included in deployment scope
Cryptography audit scope and deployment-specific validation.
- Control matrix
- Scoped for the deployment
Control mappings for the institution’s applicable requirements.
- Release evidence
- Provided for the release
Signed images, SBOM and reproducible build inputs for bank verification.
- Recovery design
- Design documented; exercises in deployment scope
Customer-controlled recovery with two escrow holders and agreed acceptance exercises.
FAQ
The questions your teams will ask.
Who holds the keys?
The customer device holds one MPC share; the bank's platform holds the other under HSM/KMS envelope encryption. Neither share can sign alone.
Does the full private key ever exist?
No. Distributed key generation produces separate shares, and the signing protocol does not assemble the full key.
Why 2-of-2 MPC?
Every signature requires both participants. Compromising only the platform or only the device is not sufficient to produce a signature.
How is the phone share protected?
It is bound to Secure Enclave or StrongBox, is non-exportable and requires biometric approval. The device verifies the transaction shown to the user.
What happens if a device is lost?
Device replacement and share refresh follow an approved lifecycle procedure. Recovery uses customer-controlled escrow holders, a quorum and a waiting period.
Who controls recovery?
Two customer-controlled escrow holders participate. Recovery authority is separate from normal signing authority and is exercised under agreed procedures.
Can the coordinator sign?
No. The coordinator is treated as untrusted, routes protocol messages and cannot see the shares.
Which chains are supported?
Four chain families—EVM, Bitcoin, Solana and Tron—across 16 networks. Confirm the required network scope in the workshop.
How are transfers approved?
The policy engine checks limits and approved addresses. Maker-checker rules and the required approval quorum apply before MPC signing.
Can operations be stopped?
Vault Actions includes freeze and kill-switch controls. Roles and procedures determine who may activate them.
Where is Fortiva installed?
In the bank's data centre or private cloud, with signing participants in separate network segments and no foreign SaaS dependency.
What infrastructure is required?
Kubernetes, PostgreSQL and integrations with the bank's HSM/KMS and operational systems. Capacity and resilience requirements are agreed during design.
How does it integrate with banking systems?
Through the corporate API and SDKs, plus scoped adapters for core banking, client ledgers, SIEM and payment workflows. The platform has 175 API endpoints and 64 event types.
Can each business line have its own policies?
Yes. Modules are enabled vault by vault, with tenant-specific roles, data boundaries, policies and audit trails.
What has been audited?
A seven-phase independent security audit is completed. An independent cryptography audit is included in every deployment scope; the evidence pack explains coverage.
How can engineers evaluate the platform?
Under NDA, the bank receives architecture and security evidence, source code escrow arrangements and sandbox access for its engineers.
How are software releases verified?
The bank can verify signed images, the software bill of materials and reproducible build inputs against its acceptance requirements.
Is Fortiva a licensed custodian?
No. Fortiva supplies software. The institution owns the customer relationship, regulatory permissions, risk decisions and custody service.
How are licensing and support structured?
A deployment project plus annual licence and L3 support, with no per-wallet or per-transaction fees. The bank operates L1/L2 support.
How does the rollout work?
Discovery, NDA and evidence review lead into design and acceptance. Deployment and the testnet-first pilot run through weeks 5–12; independent audit and production follow from month 4, subject to the agreed scope.
A shared vocabulary.
- MPC
- Multi-party computation: participants sign using separate key shares.
- Vault
- A logical custody boundary for assets, signers, policies and records.
- HSM / KMS
- Hardware and key-management infrastructure protecting the platform share.
- Maker-checker
- Separation between the person initiating an action and those approving it.
- WORM
- Write once, read many: evidence storage that prevents alteration of retained records.
- SBOM
- Software bill of materials: an inventory of the components in a release.
- DKG
- Distributed key generation: creating shares without assembling a private key.
- Travel Rule
- Transfer information requirements, mapped to the institution's applicable regime.
CONTROL AT EVERY LAYER
Put the evidence in front of your team.
Request architecture documents, security audit reports, the controls matrix and sandbox access for your engineers under NDA.