# Digital Asset Program Advisory

> Make security, custody, vendor, and operating-model decisions across a broader digital asset program.

Canonical page: https://www.guvenkaya.co/services/digital-asset-program-advisory

**Plan custody, vendors, and operations as one program.** Senior advisory for institutions and operators whose custody, settlement, and tokenization decisions span several systems, several vendors, and more than one team.

## What we advise on

We connect custody, vendor, operational, and governance decisions across the program.

- **Custody and wallet architecture**: We work through where keys live, who controls them, and what the chosen model commits you to for years.
- **Vendors and inherited trust**: We assess which controls remain with you and which depend on the vendor.
- **The operating model**: We define who runs what, which procedures have to exist, and what evidence the program produces as it operates.
- **Sequencing and readiness**: We sequence decisions and readiness checks for launch, migration, and external review.

## Best used before you choose architecture or vendors.

- **When decisions span multiple systems**: Several systems or vendors need one security view.
- **When your program is expanding**: An institution is entering or growing digital assets.
- **When you need independent judgment**: Leadership needs challenge across multiple workstreams.
- **When technical and operational decisions overlap**: Technical, operational, and governance questions cannot be separated.

## How we turn program choices into a roadmap.

1. **Define the decisions and criteria**: Agree the products, operating model, risk appetite, and stakeholders. Set the criteria for comparing architecture, custody, and vendor options.
2. **Map risks and dependencies**: Document how vendors, systems, and operations connect. Identify inherited trust assumptions, failure scenarios, and gaps in control ownership.
3. **Compare options and record tradeoffs**: Assess each option against the agreed criteria. Document its costs, risks, and control owners in a decision framework.
4. **Build the program roadmap**: Sequence security priorities and dependencies in executive and technical sessions. Set owners and decision points for delivery.

## Deliverables

- **Decision framework**: The options, what each one costs you, and who ends up owning the control.
- **Risk and dependency view**: How vendors, systems, and operations connect.
- **Program roadmap**: Security priorities in order, worked through in executive and technical sessions.

## Engagement team

- **Timur Güvenkaya**, Founder & Partner: Rust-based and non-EVM systems, protocol security, architecture, infrastructure, and custody.
- **Piotr Cielas**, Principal Advisor: Financial-services assessments, offensive security, risk leadership, CVEs, and patents.

## Frequently asked questions

### How is this different from the individual reviews?

A review takes one system and examines it. This takes the program: several systems, several vendors, and the decisions that cross between them. Advisory work usually identifies which reviews are worth running, and when.

### Do you implement, or only advise?

We advise, design, and review. We do not operate your program and we do not resell custody or security platforms, which is what lets us assess a vendor without holding a stake in the answer.

### We have already chosen a custody vendor. Is it too late?

No. That is one of the more common starting points. The questions simply move to integration, operating model, key ceremony design, role separation, and what your exit looks like if the relationship ends.

### Who from our side needs to be involved?

Usually more than one function: engineering, operations, risk or compliance, and someone who can decide when those three disagree. Include the people who can approve decisions across these functions.

### Can we focus the engagement on one decision?

Yes. A custody model, vendor choice, integration, or migration can be the starting point. We consider the dependencies relevant to that decision and agree how far the advisory scope extends.

## Related services

- [Signing & Custody Security Reviews](https://www.guvenkaya.co/services/signing-custody-security-review.md): Review key generation, signing approvals, key use, and recovery across MPC, HSM, multisig, and custody platforms.
- [Secure Architecture & Process Design](https://www.guvenkaya.co/services/secure-architecture-process-design.md): Design or assess critical systems, workflows, integrations, and operating controls before implementation or a major change.
- [Risk Assessment](https://www.guvenkaya.co/services/risk-assessment.md): Give leadership a prioritized view of where security risk concentrates and what to address first.

## Discuss your digital asset program.

Describe the program, open decisions, and deadline. We will define the advisory scope.

Discuss your scope: https://www.guvenkaya.co/contact