Skip to main content

​
Walk me through manual transfers (no automation): who signs what? How do the policy engine, enclave, and MPC fit together?

Answer: Think of it as three steps: Intent → Check → Sign:
  • Intent: A human or system creates a structured intent (who/what/where/how much). Approvers review and sign the intent (not the raw chain tx yet).
  • Check (inside Secure Policy Engine): The intent is sent into PrimeVault’s Secure Policy Engine (SPE) running inside a hardware enclave. The SPE verifies the right approvals/limits/quorums, compiles the exact on‑chain transaction inside the enclave from the approved intent, and only then authorizes signing.
  • Sign (MPC): The MPC shards produce a threshold signature for the enclave‑built transaction. No single shard sees a full key, and nothing is signed unless the SPE’s deterministic checks pass.

​
How does MPC differ from onchain multisig?

In on-chain multisig, each signer holds a full key and approves on-chain. The contract enforces rules in public, which adds gas cost and latency. In MPC, approvals and quorums are handled off-chain by the policy engine, and a single transaction is signed once the off-chain quorum is met. This reduces on-chain overhead and keeps the separation of duties without exposing full keys to any party. MPC also preserves privacy: because approvals and quorums happen off-chain, your internal governance, risk, and compliance controls are not published on-chain. With on-chain multisig, signer addresses, thresholds, and approval timing are visible to anyone, which can leak operating patterns and create targeting risks. With MPC, you still get full auditability through tamper-evident logs and attestations without broadcasting your controls publicly. You can also combine approaches, for example, policy-driven approvals with a destination contract that performs extra checks.

​
Where do MPC key shards live, and can we host them?

Shards are only ever accessible inside hardware enclaves. PV uses cloud-based TEEs or enclaves, specifically AWS Nitro. You can choose PrimeVault-hosted, customer-hosted, or a hybrid setup. In all cases, shards are generated and used inside remote-attested secure hardware. Access to shards is strictly controlled by policy, which in turn is controlled by your org’s administrators. No signature is produced unless the policy conditions are met.