# Signing & Custody Security Reviews

> Review key generation, signing approvals, key use, and recovery across MPC, HSM, multisig, and custody platforms.

Canonical page: https://www.guvenkaya.co/services/signing-custody-security-review

**Review the full path from key generation to recovery.** We review signing, custody architecture, and operating procedures, including emergency access and vendor dependencies.

## Follow authority from creation to recovery.

- **1. Generate**: Entropy, ceremonies, share or key creation, devices, participants, and evidence.
- **2. Store & distribute**: HSMs, MPC shares, backups, physical controls, cloud dependencies, and separation.
- **3. Request**: Transaction origination, policy inputs, destination controls, limits, screening, and integrity.
- **4. Approve**: Identity, role separation, quorum, out-of-band checks, escalation, and exceptions.
- **5. Sign & broadcast**: Signer behavior, transaction verification, tamper resistance, endpoint trust, and submission.
- **6. Monitor & reconcile**: Alerts, logs, chain monitoring, settlement, reconciliation, and investigation.
- **7. Recover & break glass**: Backup restoration, compromised devices, disaster recovery, emergency access, and post-event control.

## When this work fits

- **Review an existing model**: Challenge the architecture, implementation, procedures, and production controls around an operating stack.
- **Design or integrate a model**: Support vendor selection, workflow design, role definition, integration, migration, and go-live readiness.
- **Walk critical scenarios**: Examine compromise, insider abuse, vendor failure, data corruption, recovery, and break-glass paths.

## How we review signing and custody.

1. **Build the custody threat model**: Map where keys and shares live, who can use them, and which assumptions depend on vendors. Document credible compromise and failure scenarios.
2. **Trace signing and recovery flows**: Follow approvals, signing, recovery, and emergency access. Record the security properties each flow must preserve and the controls responsible for them.
3. **Test controls and document walkthroughs**: Examine code, configuration, and procedures in scope. Walk through insider abuse, vendor failure, and recovery scenarios, recording evidence and steps your team can rehearse.
4. **Verify changes and document conclusions**: Provide remediation guidance and always verify fixes through retesting. Tie the principal’s signed opinion to the reviewed architecture, procedures, and supporting evidence.

## Deliverables

- **Findings report**: Technical and operational gaps, ranked by impact and by how easily someone reaches them.
- **Threat model**: Who can move value, what stands in their way, and the failure paths we consider credible. The register includes scenarios blocked by existing controls.
- **Record of flows and security properties tested**: Signing, approval, recovery, and break-glass, each with the property it has to hold when a human is under pressure.
- **Invariant register**: Each security property, the controls assessed, and supporting evidence.
- **Control tests and walkthroughs**: Documented signing, approval, and recovery scenarios your team can rehearse again.
- **Signed opinion on the reviewed baseline**: The principal’s conclusions, tied to the reviewed architecture, procedures, and evidence.

## Engagement team

- **Piotr Cielas**, Principal Advisor: Financial-services assessments, offensive security, risk leadership, CVEs, and patents.
- **Michal Bajor**, Specialist Advisor: Exchange, funding, custody, API, web application, red-team, and L1 security.
- **Timur Güvenkaya**, Founder & Partner: Rust-based and non-EVM systems, protocol security, architecture, infrastructure, and custody.

## Frequently asked questions

### Do you verify fixes?

Yes. We always provide remediation guidance and verify fixes through retesting. The final report records the remediation status and any unresolved findings.

### Do you review MPC, HSM, and multisig models?

Yes. Scope covers the mechanism and the identity, devices, policy, quorum, integration, backups, recovery, monitoring, and procedures around it.

### Can you review a third-party custody platform?

Yes. We can examine vendor assumptions, configuration, APIs, policy, transaction workflows, recovery, monitoring, and retained controls.

### Is this a technical or operational review?

Usually both. Custody failures cross architecture, software, identity, process, people, vendor, and recovery boundaries.

### Can you help before we choose a vendor?

Yes. The design path compares trust models, operating implications, control ownership, integration risk, and exit constraints.

### Do you perform key ceremony exercises?

Key ceremony design, rehearsal, and readiness can be included or delivered through Training & Security Exercises.

### Do you need access to private keys or signing shares?

Start with architecture, policies, configuration, and operating procedures. If the review includes code, we need access to it during scoping. Do not send production private keys or signing shares with your inquiry. We agree the access and test setup needed for any signing or recovery exercises during scoping.

## Related services

- [Secure Architecture & Process Design](https://www.guvenkaya.co/services/secure-architecture-process-design.md): Design or assess critical systems, workflows, integrations, and operating controls before implementation or a major change.
- [Technical Training & Security Exercises](https://www.guvenkaya.co/services/training-security-exercises.md): Choose training on Rust, Substrate, and NEAR, or workshops, tabletop exercises, and key-ceremony rehearsals tailored to your systems.
- [Risk Assessment](https://www.guvenkaya.co/services/risk-assessment.md): Give leadership a prioritized view of where security risk concentrates and what to address first.

## Discuss your custody review.

Describe your custody model, planned changes, and deadline. We will identify the review or design scope.

Discuss your scope: https://www.guvenkaya.co/contact