Skip to main content

​
Where do approvals happen — in the web app or on phones?

Makers set up requests in the web app or over the API. Approvals happen on the approver’s phone. Each approver’s signing key is created and kept inside the phone’s secure enclave. That means the key lives in a tamper-resistant hardware area on the device where the operating system and apps (including ours) cannot read it. When you approve a transaction/dapp, etc, the enclave performs the cryptographic signature inside that protected area after you unlock the phone with your PIN or biometrics. Only the signature leaves the device, not the key itself. So even if a browser session were compromised, an attacker could not approve without physical control of the registered phone. The private key never appears in the browser, and it never sits on PrimeVault’s servers. This keeps custody clean and ties approvals to possession of the registered device.

​
How does device onboarding work? Does PrimeVault ever see our private keys?

When you invite a user, the mobile app generates a new key pair on that phone. The private key stays sealed in the device’s secure hardware. Only the public key is registered, so the system can recognize the approver. PrimeVault never receives private keys in plaintext. Each user has one active device at a time. Replacing a device requires an admin-defined recovery quorum, for example, two of three admins approving the new device, after which the previous device is revoked by policy.

​
Can we restrict devices and recover safely if a phone is lost or stolen?

Yes. We enforce one active device per user, and recovery is approval-gated. If a phone is lost or stolen, an admin quorum first approves recovery and deregisters the lost device key in policy. The user then enrols a new device. In practice, our recovery flow treats “key recovery” as registering a new device key, and the system immediately replaces the old public key with the new one, so a revoked device cannot approve anything. This requires multi-party approval to add the new device and prevents anyone from adding a second device without the configured quorum.