Three-shard MPC
Private key material is generated under a 2-of-3 threshold. On the default service key, shares are created server-side and signing reconstructs the secret in memory. You authorize every sign. This is not 'only you hold keys'.
On the default service key there is no user-held shard. Additional shares support operations and recovery. FROST-class threshold signing, where the secret is never reconstructed, is not shipped.
There is no traditional seed phrase in the wallet model. Recovery follows a structured ceremony.
Why one shard remains in the operational design
That shard is not a claim of custody over user assets. It enables:
- Quantum-resistant cryptography on key material and signatures
- Short-cycle operational rotation, targeting 72-hour cycles in production configurations
- Policy and compliance co-signing without unilateral control
The vault analogy
Most systems secure the door. JIL secures what is inside.
Unlike systems that only harden the outer gate, JIL applies post-quantum protection at the source and at the gate.
Post-quantum
Every signature is hybrid. Both halves must verify.
- Classical: Ed25519, for current interoperability
- Post-quantum: ML-DSA-65 / Dilithium (NIST FIPS 204) and related lattice-based primitives, with Kyber for key encapsulation
Both must verify. There is no downgrade path. The post-quantum module is built to be upgraded as standards and threats evolve, and a formal migration path exists so the network can move without rewriting the ledger.
Validator and operational keys are HSM-backed. Rotation is enforced on a short operational cadence.
Original stack
This security model sits on an original Layer-1 operated here by JIL Federation Technologies, Inc. Not a fork of Bitcoin, Litecoin, Ethereum, or any other chain. Holdings licenses the IP and does not operate this site.
Have your engineers read the detail
Technical briefings go into the threshold scheme, the rotation cadence, and the migration path.