How KeySigner protects your accounts

Your key's secret stays on your key

A security key is built so its private key cannot be copied out. KeySigner never asks for it. It keeps public-key material, credential details, approval rules and approval records, which is what it needs to check that the right keys approved.

Only the keys in a rule can approve

Company sign-in, billing and admin roles decide who runs the console. They are separate from the power to approve. Being a member of an organization, or signing in through your company, does not let anyone act for an account. Only the keys in that account's rule can.

Managing access is also separate from reading protected data. Being able to manage an account does not let KeySigner or an admin decrypt what that account protects.

Each account shows how far it is protected

The console marks every account as observed, coordinated or enforced. Enforced means the service accepts only the multisig credential. Coordinated means KeySigner collects approvals but a path around it still exists, such as a long-lived token or an admin bypass, and the console lists that path. KeySigner never shows a coordinated account as enforced.

What removing a key does and does not do

When a key is marked lost or removed, new approvals with it stop. Past signatures stay signed, and a server session that is already open stays open until it ends. A service's own administrators and recovery options sit outside your rule, so KeySigner lists them rather than claiming to control them.

Payments

Stripe handles checkout and invoices. KeySigner never receives your full card number.

What we do not claim

KeySigner holds no security certifications. We will list one here only after it is awarded. No service can guarantee absolute security.

Report a security problem

If you find a vulnerability or suspect someone has used your keys, email doug.lance@gmail.com. Please include the steps to reproduce it, and give us a chance to fix it before you share it publicly.