Self-custody is a claim that is easy to make and worth checking. Here is exactly what happens to your key.
Generation
Keys are generated on your device, using the platform's cryptographic random number generator. No server is contacted, no entropy is requested from anywhere, and no copy is made.
Your recovery phrase is a BIP39 mnemonic produced in the same moment. It is shown to you once, and the app does not retain a readable copy for later display without a fresh biometric check.
Storage
- iOS
The Keychain, backed by the Secure Enclave, with an access policy requiring biometric authentication.
- Android
The Android Keystore, hardware-backed on devices that support it, with the same biometric requirement.
- Not stored in
App storage, preferences, Redux state, logs, analytics, crash reports, or any network request.
Every signature goes through a single signing path in the app, and the only way key material leaves secure storage is a biometric-gated read. There is no other route to the key, including for the app's own code.
That read happens when you unlock the app, not once per transaction. The unlocked session then holds a signer in memory, so transactions you make while the app is open and unlocked are signed without prompting again. Leaving the app and returning puts the lock screen back in front of you.
Transmission
Never. Not to us, not to a node, not to an analytics endpoint, not in a crash report. The wallet broadcasts signed transactions to Solana RPC endpoints — which is the signature and the instruction, never the key that produced it.
This is checkable
Everything above is an observable property. A network capture of the app in use will show RPC calls carrying signed transactions and nothing carrying key material. We would rather you verified it than believed it.
What an attacker needs
Your recovery phrase. The complete answer. Anyone with the words has the wallet, on any device, permanently. This is why the phrase is stored offline and never typed anywhere but the import screen.
Your device, and the app already unlocked. Biometrics gate opening the app, not each individual signature — so a phone handed over, or taken, while the wallet is open and unlocked can sign. This is the realistic attack, and the defence is mundane: lock the app when you put the phone down, keep the auto-lock short, and do not leave the wallet open in public. A phone plus coercion is a different matter again, and no software solves it.
A compromised operating system. A device with malicious root access is beyond what any app can defend. Keep the OS updated and do not jailbreak or root a phone that holds funds.
What an attacker cannot do
- Obtain your key from us. We do not have it.
- Obtain it from the storage backend. It is not there.
- Recover it from a backup service. There is no such service.
- Persuade support to reset it. There is no reset.
That is the same property that means we cannot help you if you lose the phrase. The two are inseparable — see what we cannot do.
Multiple wallets
Each wallet on the device gets its own entry in secure storage under the same protections. Inheritance is configured per wallet address, so a wallet with no inheritance account behaves as a completely ordinary wallet.