> ## Documentation Index
> Fetch the complete documentation index at: https://help.primevault.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MPC + TEE Flow Semantics

## Walk me through manual transfers (no automation): who signs what? How do the policy engine, enclave, and MPC fit together?

**Answer:** Think of it as three steps: **Intent → Check → Sign**:

* **Intent:** A human or system creates a structured intent (who/what/where/how much). Approvers review and sign the intent (not the raw chain tx yet).
* **Check (inside Secure Policy Engine):** The intent is sent into PrimeVault’s Secure Policy Engine (SPE) running inside a hardware enclave. The SPE verifies the right approvals/limits/quorums, compiles the exact on‑chain transaction *inside the enclave* from the approved intent, and only then authorizes signing.
* **Sign (MPC):** The MPC shards produce a threshold signature for the enclave‑built transaction. No single shard sees a full key, and nothing is signed unless the SPE’s deterministic checks pass.

## How does MPC differ from onchain multisig?

In on-chain multisig, each signer holds a full key and approves on-chain. The contract enforces rules in public, which adds gas cost and latency. In MPC, approvals and quorums are handled off-chain by the policy engine, and a single transaction is signed once the off-chain quorum is met. This reduces on-chain overhead and keeps the separation of duties without exposing full keys to any party. MPC also preserves privacy: because approvals and quorums happen off-chain, your internal governance, risk, and compliance controls are not published on-chain. With on-chain multisig, signer addresses, thresholds, and approval timing are visible to anyone, which can leak operating patterns and create targeting risks. With MPC, you still get full auditability through tamper-evident logs and attestations without broadcasting your controls publicly.

You can also combine approaches, for example, policy-driven approvals with a destination contract that performs extra checks.

## Where do MPC key shards live, and can we host them?

Shards are only ever accessible inside hardware enclaves. PV uses cloud-based TEEs or enclaves, specifically AWS Nitro. You can choose PrimeVault-hosted, customer-hosted, or a hybrid setup. In all cases, shards are generated and used inside remote-attested secure hardware. Access to shards is strictly controlled by policy, which in turn is controlled by your org’s administrators. No signature is produced unless the policy conditions are met.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.