HYBRID DEVNET · PUBLIC EVIDENCE LIVEVerifiable infrastructure for value, markets, identity, and operational dataInspect the network

Wallets & recovery

What does self-custody mean for a business?

4 min read

Self-custody is about who controls the keys and, therefore, the authority to access and move funds. If another entity can sign transactions or change signing authority without your approval, it may be able to transfer or misuse your coins; your access may also depend on that entity continuing to cooperate. True self-custody keeps spending authority with you rather than giving a provider unilateral control. Hybrid-Chain’s native MPC wallet design separates customer authorization from distributed signing: operating signing infrastructure is not, by itself, permission to spend customer funds.

Control matters in normal use and exceptions

For a business, the question is not only where key material is stored. It is whether someone outside the customer’s agreed authority can redirect funds, change the approval rules, or replace the people entitled to act. A provider with unilateral power creates a dependency on its behavior as well as its security. A customer-controlled arrangement aims to remove that unilateral spending power while making the customer’s own responsibilities explicit.

Make the arrangement understandable

Ask for a diagram that names the actual organizations and roles, not just several servers labeled “secure.” Follow one ordinary transfer from request to authorization, signing, and completion. Then follow a recovery or administrator-change scenario. The answers should explain what an infrastructure operator can do and what still requires the customer. This is a practical way to evaluate self-custody without needing to inspect proprietary cryptographic implementation details.

What the business gains and still owns

The benefit is meaningful control over spending decisions, with less reliance on a provider choosing to honor them. That does not make business judgment unnecessary. The organization must still protect authorized access, confirm destinations, manage staff changes, and prepare for interruptions. Treat self-custody as an operating model that you can demonstrate and maintain, not a badge that replaces these tasks. Start with the highest-consequence scenarios and make their owners and permitted procedures clear.

Illustrative example

A treasury team requires its own authorization before the signing participants can act. A service operator cannot simply decide to send the business’s coins elsewhere. The team tests this boundary alongside its approval and recovery procedures.

In plain language

Recovery is an authority decision, not just a backup

A backup helps preserve information; a recovery process determines how access or authority can be restored when something is lost or unavailable. Those are related but different jobs. For a business wallet, the plan should say who can start recovery, what evidence they must provide, who approves it, and what old access is removed afterward. It should also explain what happens if the usual person, device, or service cannot participate. A process that quietly lets one provider replace the customer’s authority may change the practical custody model, even if everyday signing uses several participants. Do not assume a support team can override the rules or retrieve lost signing material. Ask for the supported procedure for your exact deployment and rehearse it in an agreed safe environment. Record responsibilities and escalation contacts without storing secret recovery material in the same document as ordinary operating instructions.

In plain language

Permission, signing, and completion are different

Think of a business bank payment: preparing the instruction, approving it, and seeing it complete are separate events. A wallet workflow also has distinct responsibilities. Authorization means the required person or policy permits a particular action. Signing means the participating systems produce the cryptographic signature needed for that action. Completion means the relevant system has accepted or settled the result under its rules. A screen displaying a wallet, or a service responding successfully, does not combine these steps into one. In Hybrid-Chain, customer authorization is separate from distributed signing participation. When reviewing a status, ask which of these stages it describes, which asset and network it concerns, and whether the evidence is current. This distinction helps prevent a common mistake: treating an informational record as permission to move money. An operator should be able to explain the stage in ordinary language without asking you to share any secret material.

Conditions & limitations

The MPC label alone does not prove self-custody. Verify who controls signing shares, administrative changes, and recovery, and whether any party can bypass customer authorization in the exact deployment. Self-custody does not eliminate compromised credentials, malicious transactions you approve, software flaws, or service-availability risks.

What to do next

Ask who can move funds without your approval, who can change that authority, and what happens if a provider is unavailable. Require an authority-and-recovery map and an agreed demonstration of the customer-authorization boundary.

Native MPC Wallets ↗Wallet buyer’s guide ↗