Three-shard MPC
Private key material is generated under a 2-of-3 threshold. On the default service key, shares are created server-side and signing reconstructs the secret in memory. You authorize every sign. This is not 'only you hold keys'.
On the default service key there is no user-held shard. Additional shares support operations and recovery. FROST-class threshold signing, where the secret is never reconstructed, is not shipped.
There is no traditional seed phrase in the wallet model. Recovery follows a structured ceremony.
Why one shard remains in the operational design
That shard is not a claim of custody over user assets. It enables:
- Quantum-resistant cryptography on key material and signatures
- Short-cycle operational rotation, targeting 72-hour cycles in production configurations
- Policy and compliance co-signing without unilateral control
The vault analogy
Most systems secure the door. JIL secures what is inside.
Unlike systems that only harden the outer gate, JIL applies post-quantum protection at the source and at the gate.
Post-quantum
Every signature is hybrid. Both halves must verify.
- Classical: Ed25519, for current interoperability
- Post-quantum: ML-DSA-65 / Dilithium (NIST FIPS 204) and related lattice-based primitives, with Kyber for key encapsulation
Both must verify. There is no downgrade path. The post-quantum module is built to be upgraded as standards and threats evolve, and a formal migration path exists so the network can move without rewriting the ledger.
Validator and operational keys are HSM-backed. Rotation is enforced on a short operational cadence.
Original stack
This security model sits on an original Layer-1 operated here by JIL Federation Technologies Not a fork of Bitcoin, Litecoin, Ethereum, or any other chain.
Have your engineers read the detail
Technical briefings go into the threshold scheme, the rotation cadence, and the migration path.