Non-custodial model

Velarum’s most important design decision is that it never holds your keys. Understanding this explains almost every other choice in the product.

Why non-custodial (HC-NC-1)

A custodial service holds your signing material and moves funds on your behalf — which makes it a single point of catastrophic failure and a regulated money-transmission surface. Velarum takes the opposite stance as a hard constraint (HC-NC-1): the server holds no private key, mnemonic, MPC share, or HSM-signable material. It assembles unsigned transactions and observes public on-chain events; signing and broadcasting always happen on your side.

How a payment is signed

Custody modes

Wallets declare one of three custody modes, none of which give Velarum signing power: self_custody (you hold the key directly), contract_account (a smart-contract account / Safe you control), and external_regulated_custody (a third-party regulated custodian you choose). In every mode the signature originates outside Velarum.

What this means for you

You always supply a Signer (see Quickstart). Velarum cannot freeze, reverse, or move your funds unilaterally; a “refund” is a new reverse payment you authorize, not a platform clawback. The upside is sovereignty and a smaller trust surface; the responsibility is that key custody and recovery are yours to design.