Where your keys are,
and who can move them

Summary, before the detail

• Private keys are generated offline and are not held in a form the web application can spend from.
• Outbound movements require multi-signature authorisation inside the cold layer; a single compromised credential is not sufficient on its own.
• In a storage plan, Qblockx has no standing ability to move your assets without your authorisation.
• We are a self-custody platform with a co-signing key: you can keep your recovery phrase entirely offline, or store it with us encrypted for convenience. The trade-off between those two is set out under who can move assets and stated honestly, not buried.
• In a deployed product (mining, investments, premium card arrangements), you have accepted Qblockx as a counterparty and that value carries our credit risk.
• There is currently no independent audit of these controls published. That is stated below, not glossed.

Key generation

Keys are created in the cold layer at wallet creation, from a cryptographically secure entropy source, and are not transmitted to the connected layer afterwards. The connected layer stores the public derivation path needed to compute your receiving addresses and to display balances. Knowing an address and a balance does not confer the ability to spend.

Your recovery material is split into encrypted shares rather than a single seed phrase, so that no one copy of one backup is sufficient to reconstruct the key. Restore is performed in the cold layer; the reconstructed key is not pushed back online as part of recovery.

Where the keys live

The cold layer is a signing environment with no inbound network exposure: no listening service an off-box attacker can query, and no path from the web tier into key storage. Material leaving it is a signed transaction, which is public anyway once broadcast.

Access to the signing environment is itself restricted and logged, and is separate from the credentials used to administer the web application. An attacker who obtains an admin password sees the dashboard, not the keys.

Multi-signature policy

A threshold of distinct keys must sign before value leaves the cold layer. The purpose is narrow and specific: it removes the single point of failure, so that one lost device, one phished operator, or one dishonest employee cannot unilaterally move assets.

For an individual wallet, the signing set is your own authorised device or share plus the Qblockx co-signing key. Your share alone is enough to move your assets where you configured it that way, which is the point of self-custody; our co-signing key exists to make unilateral action by us impossible, not to make yours impossible.

Higher tiers can require a second independent approver before any movement is accepted, which is the setting to use if the account holds more than you would tolerate losing to one compromised laptop.

Who can move assets

This depends on one choice you make at setup, and it is the most important sentence on this page, so it is not hedged.

• You can. You authorise outbound transfers; nothing moves without a signature you caused.
• Qblockx cannot move assets unilaterally while you hold your recovery material offline. Our co-signing key is one half of a threshold, not the whole of it.
• Qblockx can restrict an account administratively. We can suspend account access, for example on a fraud report. That freezes convenience, not your assets, and is a further reason to keep your own recovery material off our systems.
• Withdrawal and swap fees are deducted as published in the fee schedule; that is the one deduction we take without a per-transaction instruction.

Asset segregation

Assets you deposit to a storage plan sit at addresses derived from your own wallet, not in a pooled company balance. That is the substantive difference between segregation and a custodial exchange: on a pooled platform your claim is an IOU against a shared pot, and here your claim is against an address whose spend condition includes your key.

Company operating funds are held separately from client assets and are not used as the source for client withdrawals. If that arrangement changes, it changes here first and your plan's terms are restated rather than quietly amended.

If Qblockx stops trading

This is the question that decides whether cold storage means anything, so it gets a direct answer rather than a reassurance.

For assets in a storage plan: your recovery shares are sufficient to reconstruct your key and sweep the assets to any address you choose, using standard wallet software. The Qblockx service is what disappears, not your ability to reach your assets. That is the entire reason the architecture is built the way it is, and it is why your backups must not live only with us.

For value deployed in a product: mining rewards, investment positions and card-programme balances are claims against Qblockx. If we cease trading, those become claims in whatever process follows, alongside our other creditors. They are not swept by a recovery phrase.

What is not in place yet: there is no published insurance policy or compensation scheme covering digital assets held here, and no insolvency-remote structure has been published. Readers should assume none until one is documented with a policy number they can check.

Counterparty risk, named

Risks that depend on a party behaving correctly, stated as risks:

• Qblockx solvency. Relevant to deployed value, not to assets resting in your own cold addresses.
• Qblockx continuity. If we stop operating, self-custody recovery becomes the mechanism and your backups become the only thing standing between you and a loss.
• Upstream issuers and networks. Assets issued or bridged by third parties carry those parties' risk. A bridged or wrapped asset is a claim on its issuer.
• Card programme partners. Virtual card balances and cashback are subject to the issuing bank's programme terms, which govern, not our interface.
• Our own accuracy. Balances you see are computed by our ledger. A discrepancy is resolved by us in your favour where we caused it.

What proves any of this

Architecture is a set of claims. The controls worth having are the ones a third party can confirm, so we list what exists rather than what would sound reassuring.

Independent audit of reserves and controls

Not yet in place. Ask us for a status.

Qualified custody partner

Not yet in place. Ask us for a status.

Registered entity and number

Qblockx Ltd

Company profile you can cross-reference

Not yet in place. Ask us for a status.

Reporting a concern

If you believe an unauthorised movement has occurred, or you have identified a weakness in what is described here, contact support@qblockx.com with the wallet address and the approximate time. Security reports are read by the people who operate the signing environment, not routed through a queue.

We do not offer a paid bounty programme and we do not promise a fix timeline we cannot keep. We do promise a reply from a person, and a correction to this page when we were wrong.

If anything here is out of date, tell us at support@qblockx.com and we will fix it.