> ## Documentation Index
> Fetch the complete documentation index at: https://help.primevault.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Private Keys and Who Holds Them

## What is a wallet private key in blockchains?

On a blockchain, a “wallet” isn’t really a file or an app. It's an **account on the network** identified by a public address (for example, 0x1234…).

Behind that address, there is a secret number called a **private key**.

* The **public address** is like your email address: you can share it with others so they can send funds.
* The **private key** is more like a powerful, unguessable password combined with a stamp. It lets you **create valid signatures** that the network accepts as authorization to move funds from that address.

## Who holds the private keys, where and how?

With PrimeVault, there are **two different kinds of keys** to think about:

1. The **private keys** that actually move funds on-chain
2. The **approver device keys** that your team uses to approve actions

They are kept in different places and used for different purposes.

**a) Private keys (the ones that control the wallet)**

These are the keys that correspond to your on-chain wallet addresses.

In PrimeVault:

* These keys are **generated inside secure hardware environments** (Trusted Execution Environments, or TEEs). They are **never exported in plaintext**, written to disk, or shown to any human.
* The key is **split across multiple TEEs using MPC** (multi-party computation), so no single machine ever has the full key.
* When a transaction needs to be signed:
  * Your policies and approvals are checked by the Secure Policy Engine running inside the enclave(s).
  * Only if the rules pass does the MPC group produce a signature.
  * The signature is returned; the underlying private key never leaves the enclaves.

So the answer to “who holds the blockchain private keys?” in our model is:

“They live inside attested enclaves and MPC nodes, bound to your workspace and policies. No individual person, including PrimeVault staff, ever sees or exports those keys in plaintext.”

You retain **effective control** because:

* Your entity owns the workspace and vaults,
* Your team defines the policies,
* Your approvers' devices are the only way to satisfy those policies.

**b) Approver device keys (the ones your team holds)**

Separately, each human approver also has their own keypair on their phone:

* When a user is onboarded, the PrimeVault mobile app creates a keypair **on the device**, inside the phone’s secure hardware (Secure Enclave / Android Keystore).
* The **private part** of that key never leaves the device. The **public part** is registered with PrimeVault so the system knows which approvals are valid.
* When that user approves a transfer, policy change, or automation:
  * They see the request on their phone.
  * Their device signs the approval.
  * The platform verifies that the approval came from a registered device and then lets the enclave/MPC proceed with the actual on-chain signature.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.