# Custody Source URL: https://blockstream.com/custody Updated: 2026-11-13T21:22:03.000Z --- *BLOCKSTREAM ENTERPRISE* ## Digital asset custody solution for capital markets. Scalable custody infrastructure with end-to-end encryption and built-in redundancy, designed to meet the highest industry standards with enterprise-grade governance. - Programmable policies *BLOCKSTREAM ENTERPRISE* ## Built for the evolution of digital finance. ### Customer owned from day one. A formal key ceremony puts every key and backup in your hands, ensuring undisrupted business continuity. ### Segregate client assets by account. Prevent disruptions with provable on-chain balances for auditors. ### Per tenant isolation. Each deployment is isolated at the dedicated hardware level, with key controlled admin access and its own compute scope. Legal entities stay segregated with separate encryption. ### Meet local standards in every region. Local controls, spend policies, and approval flows adapt per entity and region. ### Approve from anywhere without loosening the quorum. Approvers can act from a mobile companion app, so signing never stalls when people travel. ### Enforce your policies before signing. Every transaction must pass your defined permissions and spending policies. K-of-N threshold approval with Drafter, Approver, and Authorizer roles, limits checked against live signed price data, and withdrawals only to approved destinations. *PURPOSE-BUILT SECURITY ARCHITECTURE* ## Secured in layers. Multi-layered infrastructure designed for resilience, scalability, and operational control. ### Never sign with blind trust. Every operation runs before and during signing, inside a TEE, validated by FIPS 140-2 Level 3 HSM at the point of signing. ### Prevent unauthorized access with configurable policy controls. RBAC and access control confirm the requesting role is permitted to create proposals. The policy engine evaluates it against configured spend policies, determining approval quorum and approver identity. ### Mirror your operating model to spending policies. The workflow engine tracks received and outstanding approvals and routes reminders until quorum is met. ### Secure your data. End-to-end encryption ensures what the approver and signer see is cryptographically bound to what gets signed. *DEPLOYMENT OPTIONS* ## Scale without switching platforms. Start on managed services and move fully on-premises as the business grows, with the same policy controls and audit trail behind every account. *TIER 1* ### Managed - Go live without buying or staffing hardware. - Blockstream operates the platform, with each client isolated on its own HSM partition. *TIER 2* ### Dedicated - Keep your own HSMs without running them. - Blockstream operates it like the managed service, without the shared clusters. *TIER 3* ### On-premises - Run the full stack in your own facilities. - The front end, message broker, TEE back end, HSM, database, and blockchain nodes all run on your premises. - **Maintain business continuity without depending on Blockstream.**: You own the keys and the restoration process, and shared environments include a seed backup held independently of Blockstream. - **Stay online with redundancy at every level.**: HSMs, databases, and servers are duplicated across geographic sites, with at least two HSMs in every deployment. - **Scale with your business.**: Easy migration path between deployment models to accommodate your business’s growth. *SIGNING OPTIONS* ## Flexible signer configuration. Choose the signing model and design a custody setup that fits your security and governance requirements. *SIGN BY* ### Single-signature - **Cryptographic operations take place inside HSMs** - **Private keys and MPC key shares never leave the HSM security boundary.** - **Hardware security module (HSM) support** - **Cloud key management services (KMS)** - **Air-gapped offline signers for physical isolation** *SIGN BY* ### Multi-signature - **Cryptographic operations take place inside HSMs** - **Private keys and MPC key shares never leave the HSM security boundary.** - **Hardware security module (HSM) support** - **Cloud key management services (KMS)** - **Air-gapped offline signers for physical isolation** *SIGN BY* ### MPC - **Cryptographic operations take place inside HSMs** - **Private keys and MPC key shares never leave the HSM security boundary.** - **Hardware security module (HSM) support** - **Cloud key management services (KMS)** - **Air-gapped offline signers for physical isolation** *PROGRAMMATIC ASSET LIFECYCLE* ## Granular control of every asset, from issuance to settlement. Governed by your defined rules, enforced for every transfer that follows. ### Issue, reissue, and burn. Set the initial supply, add supply when you need it, and burn from circulation under issuer authority. ### Freeze. Lock a wallet, an asset, or a single holding whenever your policy requires it. ### Settle. Delivery and payment in one transaction, with two-minute finality. *DIGITAL ASSET ISSUANCE* ## Enable tokenization when you’re ready. Run issuance and custody without a second system to keep in sync. Tokenize, manage, and custody your digital assets on one platform under the same controls. - [Explore Tokenization](https://blockstream.com/tokenization) *INTEGRATION. SDK. API.* ## Integrate with your existing infrastructure. Deploy alongside your existing core banking, identity providers, and operational systems with no disruption to current workflows. ### Build with the SDK in your team's language. Blockstream Enterprise SDK ships in JavaScript and Rust, with Go, Python, and Swift bindings on request. ### Connect the tools you already run. Connectors plug in price oracles, observability, SSO, and risk and AML tooling. ### Dedicated support. Get help from Blockstream's enterprise support team. *OVER 12 YEARS' EXPERIENCE* ## Why choose Blockstream? ### Strong foundation. Blockstream was founded by Dr. Adam Back, inventor of Hashcash, the proof-of-work scheme cited in the bitcoin whitepaper. ### Research with deep roots. Blockstream Research contributed to Taproot, libsecp256k1, and post-quantum solutions alongside the wider open-source community. ### Operating history. We’ve been building on bitcoin since 2014. ### Engineering depth. Renowned software engineering specializing in bitcoin, cryptography, and smart contracts. ### Bitcoin-first innovation. We’re key contributors to bitcoin, enhancing its security, privacy, and efficiency for over a decade. *GET STARTED* ## Build your financial infrastructure on bitcoin. Speak with our enterprise solutions team to design custody, settlement, and operational workflows tailored to your firm's standards and operations. - [Request demo](https://blockstream.typeform.com/to/SWKNyzvS?typeform-source=blockstream.com) - [Contact us](https://blockstream.typeform.com/to/SWKNyzvS?typeform-source=blockstream.com)