No passwords
Anchorage Digital forgoes the use of usernames and passwords, which are susceptible to fraud, impersonation, and abuse.
No emails or texts
Anchorage Digital does not use emails or phone numbers, so attackers cannot gain access by triggering email or SMS-based account recovery.
No unauthorized devices
Only pre-approved devices may access an account.
How it works
Anchorage Digital’s transaction flow is designed to prove with certainty that a given transaction reflects an organization’s intent. Once all three steps are complete, we process the transaction within minutes.A 3-step transaction process
1
Multi-user approval
Every transaction requires approval from at least two members of the organization, using authentication through authorized devices. Each user’s identity is tied to a unique and unforgeable cryptographic key, created and stored in the iOS Secure Enclave.
2
Transaction review
Using automated outlier detection and human oversight, Anchorage Digital authenticates each approval based on detailed behavioral analytics. Individual and organization behavioral data—including biometrics, transaction details, and location—is examined and compared against historical patterns to detect and flag any outliers. Every transaction is independently reviewed by Anchorage Digital; no transaction moves forward without human confirmation.
3
Hardware-enforced logic
Hardware Security Modules (HSMs) process the transaction only when both the organization and Anchorage Digital have approved. Private key material is generated and processed in air-gapped HSMs and is not exported outside the HSM boundary in plaintext. The system signs transactions without exposing sensitive key material. Custom logic verifies that each operation has a valid quorum of client approvals as well as Anchorage Digital approval.
User permission levels
The platform has three user permission levels: Administrator, Operator, and Viewer. Users can hold multiple roles, and each vault can have its own user access configurations.Administrator
Full access to perform administrative tasks, including the ability to create and modify policies.
Operator
Access to perform operations in a vault policy, including initiating withdrawals or staking operations.
Viewer
View permissions to vaults and the ability to download statements or reports.
Administrator scoping isn’t fully granular yet. A user scoped to a specific administrator rule can still initiate—though not approve—other administrator operations. More granular administrator separation is on the roadmap.
User actions across devices
User actions are determined by the device used.Biometric approval is always required on iOS, even when quorum is not. Tapping approve isn’t the security step — your biometrics unlock the signing key held in the device’s secure hardware, which is what actually authorizes the operation.
How iOS and API approval differ
Both interfaces prove the same thing — that an authorized party approved the operation — but they prove it differently:- On iOS, the approver is a person, in the moment. Biometrics bind the approval to a specific human on a specific enrolled device, and unlock the key in the device’s secure hardware to sign.
- Over the API, the approver is a system — but a human quorum can still stand behind it. There’s no person in the loop to scan each request, so authorization comes from a cryptographic signature: sensitive requests are signed with your Ed25519 key, and each key is scoped by permission groups. For certain permission groups, key creation and/or permission changes require quorum approval and Anchorage Digital review. That human approval is front-loaded (when required), then reused for each signed request rather than collected again per transaction.
Quorums and policies
All sensitive operations—such as withdrawing assets or changing account settings—require approval from multiple members of your Anchorage organization. Each vault operates under a vault policy, which defines the user access configuration for that vault. A vault policy may be assigned to multiple vaults, ensuring that the same permission level and rules for operation approval are consistently applied across all of them.Vault members
Each vault must have a minimum of 3 members.
Quorum approvers
Each vault must have a minimum quorum of 2 approvers.
Sub-quorum customization
Set separate approval quorums for withdrawal, staking, and governance operations within the same vault policy.
- Customize the quorum and sub-quorums for user management, trusted destination management, and vault and API management operations
- Add or remove users from vault and account sub-policies
Why HSMs?
A Hardware Security Module (HSM) is a dedicated, tamper-resistant device built for one job: generating and using cryptographic keys without ever exposing them. They’re the same class of hardware banks use to protect payment systems, and they’re the answer to the core problem in digital asset security — a private key is just data, and data can be copied.- Key material stays inside secure hardware. Private key material is generated and processed in HSMs with no direct connection to the internet. Key material is not exported outside the HSM boundary in plaintext; signing happens in protected hardware, which returns only the signature.
- Tamper resistance is physical. The HSMs are air-gapped and housed in protected data centers with 24/7 physical security. Attempts to physically open or probe the hardware destroy the keys rather than reveal them.
- The approval logic runs in the hardware, not around it. Custom logic on the HSM verifies that every operation carries a valid quorum of client approvals plus Anchorage Digital approval before it will sign. The rules can’t be bypassed by compromising a server or an app, because the server and app never hold sensitive key material.