> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.finrock.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Finrock Wallet Types: MPC, Legacy KMS, and HSM Cold Storage
> Choose between MPC wallets, legacy KMS wallets, and HSM cold storage based on your security requirements and operational workflow.
Finrock supports three distinct wallet architectures — MPC wallets, Legacy KMS wallets, and HSM cold storage — each designed for different security postures and operational requirements. Understanding the trade-offs between them helps you select the right approach for your custody strategy, whether you prioritize automation, self-custody of key material, or the highest possible physical security.
## MPC Wallets (Recommended)
MPC wallets are Finrock's default and recommended wallet type for most operational use cases. They use threshold cryptography to split key material across independent signing nodes, so the full private key is never assembled at any point — not during creation, signing, or storage.
**How it works:**
* Key shares are distributed across Node A (your application server), Node B (Finrock Mobile App, user-controlled), and Node C (backup/DR node).
* A signing threshold (e.g., 2-of-3) determines how many nodes must participate to produce a valid signature.
* Nodes communicate over encrypted P2P channels. No key material is ever transmitted between them — only partial signatures.
* Distributed Key Generation (DKG) ensures the full private key never exists, even during wallet creation.
**Best for:**
* High-volume operational workflows
* Automated transaction processing
* Businesses requiring institutional-grade security without air-gapped hardware
MPC wallets support ECDSA (secp256k1) for Bitcoin, Ethereum, and EVM chains, and EdDSA (Ed25519) for Solana. See [How MPC Wallets Work](/concepts/mpc-wallets) for a full architectural overview.
## Legacy KMS Wallets
Legacy KMS wallets give you complete ownership and control of your private keys by hosting a Key Management Server (KMS) on your own infrastructure. Finrock's backend servers never access your private keys, mnemonic phrases, or wallet seeds at any time — by design.
**How it works:**
* You deploy the `finrock/ng-signer` Docker image on your own VM (AWS or Azure recommended).
* Your KMS **polls** Finrock at regular intervals to pick up pending signing jobs — Finrock never pushes tasks to your KMS.
* The KMS signs transactions locally and encrypts them before dispatching to the blockchain.
* All communication is one-way, end-to-end SHA-512 encrypted. All inbound (ingress) traffic to the KMS must be blocked; only outbound (egress) traffic is allowed.
**Deployment:**
```bash theme={null}
docker pull finrock/ng-signer
```
**Config file (Legacy mode):**
```json theme={null}
{
"signer_node": "LEGACY",
"signer_id": "2df047e7-xxxxx-xxx-xxxxx-77673f0be16c",
"rsa_prv_key": "rsa-----xx",
"srds": [
"YW1vdW50IGFixxxxxxxxxxxxxxxxxxxyIG1vb24=",
"YW11c2VkIGFiYW5kbxxxxxxxxxxxxRyZXNzIGdyZWF0"
]
}
```
**Running the signer (detached container):**
```bash docker run theme={null}
docker run -d --restart always --name finrock \
-v "$(pwd)"/config.json:/app/config.json:ro \
finrock/ng-signer
```
```yaml docker-compose theme={null}
version: '3'
services:
signer:
image: finrock/ng-signer
container_name: finrock
restart: always
volumes:
- ./config.json:/app/config.json:ro
```
**Environment variables:**
| Variable | Type | Description |
| ------------------------- | ------- | ------------------------------------------------------ |
| `FINROCK_SIGNER_MODE` | ENUM | Set to `LEGACY` for this wallet type |
| `FINROCK_SIGNER_ID` | UUID | Unique signer ID provided by Finrock |
| `FINROCK_RSA_PRV_KEY` | RSA key | Your RSA private key |
| `FINROCK_PASSPHRASE` | String | Passphrase to encrypt the MPC keystore (MPC mode only) |
| `FINROCK_MNEMONIC_PHRASE` | String | 12-word seed phrase |
| `FINROCK_SECRET` | String | Encrypted mnemonic phrase |
| `FINROCK_API_HOST` | String | Defaults to `https://sapi.finrock.io` |
**Key operational features:**
* **Kill switch:** Instantly take the KMS offline to halt all transaction signing.
* **Recovery option:** Generate new private keys for specific addresses or address groups if needed.
Your KMS host **must** block all inbound network traffic. Only outbound (egress) connections to Finrock's API are required. Exposing the KMS to inbound traffic defeats its security model.
## HSM Cold Storage
HSM (Hardware Security Module) cold storage provides the highest level of physical key security available in Finrock. Private keys are stored inside tamper-resistant hardware devices that are never connected to the internet, making remote extraction or exploitation impossible.
**Hardware specification:**
* **Standard:** FIPS 140-2 Level 3 compliant HSMs
* **Recommended device:** [Yubi HSM-2 FIPS](https://www.yubico.com/gb/product/yubihsm-2-series/yubihsm-2-fips/)
* Full key isolation with zero internet exposure
* Physical tamper protection against unauthorized access or key exfiltration
**Air-Gapped QR Code Signing Workflow:**
Create a transaction from the Finrock platform. The platform converts it into a PSBT (Partially Signed Bitcoin Transaction) or equivalent unsigned payload.
The unsigned payload is rendered as a QR code on your Finrock workspace. No network transfer occurs at this stage.
Take your air-gapped device running the Finrock Mobile App — with Wi-Fi disabled, mobile data off, and in airplane mode — and scan the QR code. The app has no network access.
The Finrock Mobile App signs the transaction entirely offline using private keys stored in the device's secure enclave or connected HSM. The signed transaction is displayed as a return QR code.
Scan the return QR code back into the Finrock platform. The platform broadcasts the signed transaction to the blockchain network.
**Key benefits:**
The signing device never requires a network connection. Remote exploits and malware are impossible by design.
Industry-standard certification for tamper-resistant hardware used in government and regulated financial environments.
Keys are stored inside hardware designed to destroy itself if tampered with, preventing physical extraction.
Designed for real-world treasury operations — not just security theory. The QR workflow makes air-gapped signing practical at scale.
**Best for:**
* High-value treasury reserves and cold storage
* Environments with strict physical security requirements
* Institutions that cannot accept any online key exposure under any circumstances
## Choosing the Right Wallet Type
| | MPC Wallets | Legacy KMS | HSM Cold Storage |
| --------------------- | ------------------------ | ------------------------- | ----------------------- |
| **Key location** | Distributed across nodes | Your infrastructure | Offline hardware |
| **Internet exposure** | Encrypted P2P only | Egress-only polling | None (air-gapped) |
| **Operational speed** | Fastest (automated) | Near-real-time | Manual (QR workflow) |
| **Self-custody** | Shared (Node B) | Full | Full |
| **Best use case** | Day-to-day operations | Compliance-driven control | Treasury / cold storage |
| **FIPS certified** | — | — | ✓ Level 3 |
Many institutions combine wallet types: MPC wallets for operational liquidity and hot wallets, with HSM cold storage for long-term treasury reserves. You can use both within the same Finrock workspace.