Home › Security

Security at the asset level

Three-shard MPC. Post-quantum at the source and at the gate. Short-cycle rotation. Designed so that compromise of the perimeter is not compromise of control.

2.8M lines·350+ services·Built from scratch·Post-quantum at source and gate·Tier 1 and Tier 2 ~30 days·Live reference cells

Three-shard MPC

Private key material is generated under a multi-party computation scheme with a 2-of-3 threshold. The key is split into three shards. No single party holds a complete private key. A valid signature requires the threshold. The full key is never reconstructed in one place.

The user retains a shard for self-custody control. Additional shards support operations and recovery under the platform design, without granting unilateral spending authority.

There is no traditional seed phrase in the wallet model. Recovery follows a structured ceremony.

Why one shard remains in the operational design

That shard is not a claim of custody over user assets. It enables:

  • Quantum-resistant cryptography on key material and signatures
  • Short-cycle operational rotation, targeting 72-hour cycles in production configurations
  • Policy and compliance co-signing without unilateral control

The vault analogy

Most systems secure the door. JIL secures what is inside.

If an attacker breaks the perimeter, even the vault, the assets remain under a scheme that still requires the threshold of shards and post-quantum signatures. Possessing ciphertext is not possessing control.

Unlike systems that only harden the outer gate, JIL applies post-quantum protection at the source and at the gate.

Post-quantum

Every signature is hybrid. Both halves must verify.

  • Classical: Ed25519, for current interoperability
  • Post-quantum: ML-DSA-65 / Dilithium (NIST FIPS 204) and related lattice-based primitives, with Kyber for key encapsulation

Both must verify. There is no downgrade path. The post-quantum module is built to be upgraded as standards and threats evolve, and a formal migration path exists so the network can move without rewriting the ledger.

Validator and operational keys are HSM-backed. Rotation is enforced on a short operational cadence.

What else sits on this model

  • ATCE: identity and policy evaluated before settlement, fail-closed
  • Hybrid signatures on every material movement: Ed25519 plus ML-DSA-65
  • HSM-backed validator and operational keys
  • CourtChain receipts so a later examiner can verify, not trust a log file
  • Wallet recovery as a ceremony, not a seed phrase on paper

Honesty bound: post-quantum identities and hybrid seals are present from genesis. An independent external security audit of the full consensus path is the named next gate, not a claim of one already published.

Original stack

This security model sits on an original Layer-1: approximately 2.8 million lines of source code across more than 350 services. Not a fork of Bitcoin, Litecoin, Ethereum, or any other chain.

Have your engineers read the detail

Technical briefings go into the threshold scheme, the rotation cadence, and the migration path.