> ## Documentation Index
> Fetch the complete documentation index at: https://help.primevault.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Best Practice Guide to Secure & Compliant Digital Asset Operations

Your PrimeVault wallet workspace uses a multi-layer, zero-trust security architecture to ensure every wallet interaction is safe, cryptographically verified, and compliant. However, your workspace is only as secure as the policies you configure.

Implementing strong governance, rooted in the **Maker-Checker** and **Least-Privilege principles**, together with continuous monitoring of access policies, helps ensure the safety of your assets and the smooth running of your operations.

These guidelines cover all employees, contractors, and service providers who interact with company-controlled wallets on PrimeVault, including operational, treasury, and engineering personnel.

## 1. Control Objectives

To maintain institutional-grade security, focus on four key areas:

* **Authorization:** Defining exactly who can access wallets and approve transactions.
* **Segregation of Duties (Maker-Checker):** Ensuring no single individual can initiate and execute a high-risk action alone.
* **Monitoring:** Continuous oversight to detect anomalous or unauthorized activity in real-time.
* **Auditability:** Maintaining immutable records for internal reviews and regulatory compliance.

## 2. PrimeVault’s Security, Monitoring & Compliance Toolkit

PrimeVault leverages MPC (Multi-Party Computation), Secure Enclaves, a formally verified policy engine, and a rich hierarchy of Orgs, Vaults, and Roles to enable extensive flexibility, modularity, safety, and auditability across every use case.

Here are some tips on how to leverage these to configure a safe and compliant operational environment for your organisation:

### Workspace Administration

* **Entity Segregation:** Create distinct workspaces for each legal entity to keep assets logically and legally separated.
* **Vault Stratification:** Use separate vaults for customer funds vs. corporate treasury (e.g., "Treasury Ops" vs. "Omnibus Wallet").
* **Role-Based Access Control (RBAC):** Assign permissions via the console using the **Least-Privilege Principle;** no user should have access to more vaults or duties than necessary.
  * **Workspace Owner:** High-level management.
  * **Admin:** Policy and infrastructure configuration.
  * **User:** Limited signer or transaction creator (Maker) in specific vaults.
  * **Auditor:** View-only access for compliance monitoring.
* **Cold vs. Hot:** Segregate reserve funds (cold/offline signing) from funds needed for active transfers (online signing).

> [!WARNING]
>
> **CRITICAL: The "Rule of Three" for Admins**
>
> You should have at least **3 Owners + Admins** in your workspace.
>
> * **Why?** Privileged operations (such as changing policies or whitelisting) often require a 2-signature quorum.
> * **Risk:** If you have only 2 admins and one loses their key, your workspace could be left in limbo, locking you out of administrative functions.

### Transaction Policies

Configure the PrimeVault Policy Engine to enforce the **Maker-Checker** workflow:

* **Approval Quorums:** Require multi-approver workflows for transactions above specific thresholds.
  * *High-Value Vaults:* For main omnibus/treasury vaults, limit signing privileges to a small set of trusted users and enforce higher approval quorums.
  * *Admin Policies:* All "Admin quorum policies" (which govern sensitive workspace changes) should be set to **at least 2** (ideally higher).
* **Destination Restriction:** Block transfers to unwhitelisted addresses unless specifically approved.
* **Asset-Specific Limits:**
  * Set daily outflow caps per asset.
  * Limit asset types per team (e.g., stablecoins only for the Treasury team).
* **Advanced Vigilance:** Enforce higher approval thresholds for custom smart contract calls, raw signing, or transactions on unsupported blockchains. This applies to pre-authorized and batched transactions as well.

### Session & Key Security

* **MFA:** Enforced by default for all PrimeVault logins.
* **Hardware Isolation:** Separate transaction initiation and approval (signing) interfaces/devices are present by default.
* **Identity Management:** Use SCIM or SSO for seamless integration.
* **Auto-Enforcement:** Session timeouts and device-level approvals are automatically enforced.

### Monitoring & Alerts

Enable alerts to detect anomalies immediately:

* **Large Transfers:** Set thresholds for immediate notification.
* **AML/KYC Compliance:** Depending on your jurisdiction, you may be required to monitor wallet activity. PrimeVault supports out-of-the-box integrations with transaction monitoring services like Elliptic.

## 3. Internal Processes & Controls

### Wallet Usage Policy

Document these clearly for your team:

* **Access:** Who can access which wallets?
* **Movement:** How and when funds can be moved
* **Approvals:** Who is authorized to approve specific transaction types?

### Key People & Separation of Duties (Maker-Checker)

* **Dual Control:** Enforce dual control for all treasury transactions (ideally 2-of-3 quorums).
* **Maker-Checker:** The Initiator (Maker) cannot approve their own transaction.
* **Admin vs. Approver:** Where possible, Approvers (Signers) should be different individuals from the Admins (Policy Managers).
* **Compliance Review:** A Compliance Officer should perform periodic (ideally quarterly) reviews of all users, policies, and activity logs.

### Reconciliation & Reporting

* **Reconciliation:** Perform daily or weekly reconciliation of wallet balances against internal books.
* **Logs:** Maintain transaction logs for all internal fund movements.
* **Audits:** Conduct periodic internal audits and control reviews to ensure policies remain effective.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.