Every wallet infrastructure provider says it is secure and reliable. These questions get past the adjectives. We've answered each for Valtu, including where the answer is "not yet".
Keys and control
- Where are private keys generated and used? Ours: only inside hardware enclaves, one set per workspace.
- Can the provider move our funds on its own? Ours: no. Your workspace's policies decide what is signed, and Valtu doesn't approve or co-sign your transfers.
- Are approvals enforced only by your servers, or by the key holder itself? Ours: with team signing, approvals are verified inside the enclave, so a compromised server can't forge them.
- Can we verify what code holds the keys? Ours: yes. The enclave image is reproducible, its measurement is published, and anyone can check the running service's hardware-signed attestation. See verify the code that holds your keys.
Money movement
- Can a retried request ever pay twice? Ours: no. Every payout carries your
externalId. See retry-safe payouts. - When is a deposit final, and what happens in a reorganization? See when is a deposit final.
- How are network fees handled for token payouts? See why token payouts need gas.
- Which networks and coins, exactly? Ours are listed live on the networks page.
Operations
- How do we find out when something happens? Ours: signed webhooks (Ed25519 and HMAC), retried, with a delivery log. See webhooks you can trust.
- Is there a public status page? Ours: status.valtu.io, checked every minute.
- Can we screen deposits and payouts? Ours: yes, with your own provider account. See screening with your own KYT provider.
Assurance
- Has an independent firm audited it? Ours: an internal security review is complete, and the external audit is not done yet. It's required before the service holds significant customer funds. The current status is always on our security page.
Ask every provider the same twelve, and ask for evidence with each answer.