Every custody provider says your keys are safe. The honest question is: how would you know? Valtu is built so that you can check, without an account and without taking our word for it.
Keys that live only in enclaves
Wallet seeds are generated and used only inside hardware enclaves: isolated environments with no disk, no network access and no way for an operator to log in. Secrets are released to an enclave only when its image matches the published measurement.
Proving what's running
You can ask the enclaves to prove which image they're running, at any moment:
- Pick a random nonce and call
GET /v1/attestation?nonce=…. No API key is needed. - Each enclave host returns a document signed by the hardware vendor, with a certificate chain up to the vendor's published root.
- The document contains the image measurement (PCR0), your nonce, so you know it was made just now, and the public keys the enclave holds.
- Compare PCR0 with the published measurements, and the keys with the published keys.
- Production runs two enclave hosts: every document must pass.
The wallet kit includes verifyAttestation, with no dependencies, so you can read exactly what it checks.
Reproducible builds
A measurement only means something if you know what it measures. The enclave image is built reproducibly: everything that affects PCR0 is pinned, so anyone with the source at the release commit gets the same measurement. The current release was built twice from scratch with identical results.
Keys from an offline ceremony
Production keys were created on 13 October 2026 on a machine that has never been connected to a network. Their public keys are compiled into the image, so the measurement covers them too. A backup is split with Shamir secret sharing and held offline.
What isn't done yet
We'd rather you hear it from us:
- An external security audit hasn't been done yet. It's required before Valtu holds significant customer funds. An internal security review is complete, with one finding still open.
- A second, independent rebuild of the release, by someone outside the team, is still owed.
- Full disaster recovery hasn't been drilled yet; restart, rollback and host failover have.
The security page keeps this list up to date as each item closes.
Try it
The attestation guide walks through the check with code. If your team would like to review it with us, get in touch.