SECURITY BY ARCHITECTURE
A device share and a platform share act together. Policies, approvals and verifiable evidence govern every movement of value.
2-of-2 MPC
Distributed key generation creates separate shares; proactive refresh renews them without changing the public address. Customer-controlled recovery uses two escrow holders, an approval quorum and a waiting period. Recovery authority is separate from routine signing, and recovery exercises are part of deployment acceptance.
The policy engine enforces whitelists, limits and maker-checker approvals. Seven user roles and four service roles separate responsibilities. A kill switch can halt operations. Hash-chained records and a WORM evidence archive preserve the decision trail; operational secrets stay in a dedicated vault.
Protocol references and control mappings. These are not product certifications.
| Regulatory framework | Fortiva control mapping | Evidence status |
|---|---|---|
| NIST IR 8214 | Threshold cryptography architecture alignment. | Control mapping |
| DKLS23 | Threshold ECDSA for secp256k1 chains. | Protocol reference |
| FROST · RFC 9591 | Threshold signing for Ed25519 chains. | Protocol reference |
| FIPS 140-3 HSM | Hardware protection reference for the bank-selected HSM. Validation depends on the deployed hardware and configuration. | Hardware-dependent validation |
| CCSS | Key lifecycle, access separation and recovery control mapping. | Control mapping |
| ISO/IEC 27001 | Access control, logging and operational security controls mapping. | Control mapping |
| TÜBİTAK | Information-systems criteria mapped to deployment controls and evidence. | Control mapping |
| Independent security audit | Seven-phase independent security audit completed. | Completed security audit |
| Independent cryptography audit | Included in every deployment scope. | Deployment-scoped cryptography audit |
CONTROL AT EVERY LAYER
A seven-phase independent security audit has been completed. An independent cryptography audit is part of every deployment scope. Signed images, an SBOM and reproducible build inputs let the bank verify what it runs. Request the evidence pack under NDA.
FORTIVA
Start with a discovery workshop for your product, operations and engineering teams.
