Security model

Wallet-native approvals with evidence first

The wallet signs last.

FlowVault separates trust from the wallet prompt: simulate the action, enforce policy, record the decision, then ask the wallet for the final signature. No custody. No private keys.

Trust ledger

What FlowVault can and cannot do

keys excluded

01 / Custody

Never holds funds

Wallet remains the control plane

02 / Private keys

Never collected

No seed phrases, no custodial secrets

03 / Signing

Wallet-native

FlowVault explains before the wallet opens

04 / Simulation

Pre-approval

Expected balance, fee, quote age, and failure states

05 / Policy

Guardrailed

Rules can pass, warn, require review, or block

06 / Record

Receipt-backed

Reviewer, signer, policy state, and tx signature

Signing model

FlowVault is the review layer, not the signer.

The safest part of the product is the order of operations: evidence first, policy second, wallet last.

01

Prepare

Action arrives

Route, token, amount, quote age, and intent are normalized into one review packet.

evidence captured
02

Simulate

Outcome is read

FlowVault shows expected balance changes, fees, warnings, and possible errors before approval.

evidence captured
03

Constrain

Policy decides

Guardrails compare the action against amount, token, slippage, route, and quote-age rules.

evidence captured
04

Sign

Wallet opens last

The connected wallet owns the final signature. Private keys never enter FlowVault.

final authority

Decision packet

Signed only after review.

Route

USDC wallet -> Raydium CLMM -> SOL wallet

Simulation

-1,240 USDC / +7.82 SOL / fee 0.000012

Policy

Balanced threshold asks for human review

Signer

Wallet prompt locked until review is complete

Receipt

Reviewer, policy state, signature, timestamp

Wallet-native boundary intactprivate keys never enter

Risk controls

Each approval carries the evidence needed to say yes, wait, or block.

Compact controls make the review explicit without turning the signer into a forensic analyst.

Wallet-native signing

FlowVault does not custody funds or sign transactions for you.

EvidenceNo custody boundary
SignalSigner locked until review

Simulation before approval

Expected balance changes, fees, quote age, and possible errors are surfaced before signing.

EvidenceBalance delta preview
SignalQuote age and fees visible

Policy guardrails

Workspace rules can pass safe actions, require human review, or block high-risk routes before signing.

EvidenceAmount, token, slippage
SignalPass / review / blocked

Recorded decisions

Reviews, signers, policy state, and final signatures become a readable audit trail.

EvidenceDecision chain saved
SignalSigner, reviewer, tx

Receipt before signing

Put every prepared action through the same safety order.

Route, simulation, policy, reviewer, signer, and final transaction signature stay attached after the wallet approves.