What Ziklag can and cannot do

This is the page a security reviewer should read first. It states the guarantees, names the mechanism that produces each one, and then states the risks that remain — because a security document that lists only its strengths is read by exactly the audience that will notice the omission.

The whole page in one picture. Everything below is the detail behind it.

Ziklag can

	Mechanism
Derive receive addresses from your stored extended public keys	BIP-32 public derivation, M/0/{i}
Observe on-chain activity for those addresses	Chain event streams plus a reconciliation sweep
Construct unsigned transactions	Per-chain adapters, from public state
Broadcast what your Edge has already signed	Chain RPC

Ziklag cannot

	Why not
Derive any private key	An xpub contains a public key and a chain code. Deriving a child private key requires the parent private key. This is arithmetic, not policy
Sign any transaction	Signing needs a private key. See above
Move any funds	Follows from the previous two
Reconstruct your mnemonic	It is never transmitted, and the identity key derived from it is published as a public key only

None of the four is a commitment Ziklag makes and could quietly stop honouring. They are properties of what Cloud holds. If Ziklag wanted to change them it would have to ask you to send it your mnemonic, which is a request you would notice.

The same holds while a Ziklag engineer is looking at your account. A support session is bounded by what Cloud can do at all, which is the list above — and, on top of that, by an explicit set of refusals covering everything that is reversible only by you. Those are enforced in the service rather than hidden in an internal screen, and you are emailed and shown the session in your own audit log every time one opens. See Support access.

Where the key material lives

Inside the Edge process, and nowhere else:

• The mnemonic is read once at boot from PASS_PHRASE_FILE, copied into an mlocked memory region so it cannot be paged to swap, and the source buffer is zeroed.
• The master seed and master key are derived in that same region.
• Child private keys are derived on demand, used to sign, and zeroed. Never persisted.
• The Edge identity key at m/83696968'/0'/0' is Ed25519, derived rather than enrolled. Only its public half ever leaves.

Nothing in that list is written to the Edge's data directory. What is written there is the outbox, the enrolment record, the identity fingerprint, the chains registered, the pool high-water marks for Solana and Stellar, and a SHA-256 digest of the API key — enough to notice a key rotation, useless to whoever can read the volume.

The identity key, and why it is derived

Deriving the identity rather than enrolling one buys two things.

Replicas need no coordination. Ten Edge containers started from the same mnemonic all compute the same identity, so they present to Cloud as one Edge with no registration handshake. Horizontal scaling is therefore free of any consensus step.

Cloud gets an integrity check for nothing. If the identity key changes, the mnemonic changed. Cloud pins the first one it sees and refuses to derive against a different one until an account owner approves it with a fresh TOTP code.

That gate exists because a changed mnemonic derives different addresses, and anything already sent to addresses from the old mnemonic becomes unreachable from the new one. It is the only decision in the product that can orphan customer funds, which is why it is deliberately hard to make by accident. Addresses derived from prior extended public keys stay monitored forever regardless, so nothing already issued stops being watched. See Identity rotation.

Residual risks

An extended public key reveals a transaction graph

This is the real cost of the model and it is unavoidable.

Holding your extended public keys means Ziklag can derive every address you will ever issue on a chain, and therefore observe every balance and every flow across all of them — including linking addresses to each other, which an outside observer of the chain cannot do as easily. It is the same information the monitoring you are paying for requires, so there is no version of this product that does not have it.

What is done about it: those keys are encrypted at rest, never written to a log, and never rendered anywhere beyond an eight-and-four character preview. What is not claimed: that Ziklag cannot see your customers' balances. It can.

A lost mnemonic is a lost wallet

No reset, no escalation, no escrow. Treat the phrase the way you treat an HSM master key, and read Mnemonic management before you go live rather than after.

What a compromised Cloud could still try

Cloud cannot sign. It can propose: construct a transaction and ask your Edge to sign it. Against a fintech's normal flow that fails, because your application initiates sends and your Edge signs what it was asked for. The attack that matters is quieter — draining an address ChainOS is allowed to draw on autonomously, one legitimate-looking top-up at a time, each individually plausible.

Four guardrails, all Edge-side, because a cap Cloud enforces is worthless when Cloud is the compromised party:

• A per-chain, per-period cap, persisted to the Edge's own store — a cap held in memory is bypassed by restarting the container. The window rolls rather than aligning to a calendar day, which would allow two full caps in two minutes across midnight. Admission and recording happen in one transaction, so two concurrent requests cannot both take the last of the cap.
• Only a gas tank may be the source, verified independently. The Edge derived the tank addresses itself, so it confirms a request targets one without trusting Cloud's assertion. This is the check that stops a compromised Cloud pointing an autonomous spend at a customer deposit address. A chain whose address codec the Edge does not carry permits no autonomous spend at all — an unverifiable source is refused, not trusted.
• Every autonomous spend is audited with its purpose and the transaction it enabled. A top-up with no corresponding sweep behind it is the signature of the attack, and only visible if the link is recorded.
• Exhaustion alarms rather than stopping silently.

The caps default to zero, so an Edge permits no autonomous spend until one is configured deliberately. The one production caller is the sweep engine, which tops a deposit address up with gas so it can pay the fee to move its own tokens — and the guardrails above were built before it, because a guardrail added after the capability it guards never lands.

A compromised Edge is a compromised wallet

Symmetrically and unavoidably: the Edge holds the keys, so whoever controls the Edge controls the funds. The mitigations are the ordinary ones — mount the mnemonic read-only at mode 0400, bind the local API to loopback, keep the container image current, and use a PKCS#11 or KMS keystore on Ultimate if the mnemonic should not be in process memory at all (Keystores).

Ziklag can stop serving you

A subscription that ends, a commercial dispute, or Ziklag ceasing to exist. What that cannot do is make funds unreachable: every address reports an absolute derivationPath, and your mnemonic plus that path recovers the key with any standard BIP-32 tool and no ChainOS involved.

Short of that, a lapsed subscription blocks API access and refuses new address generation while monitoring of your existing addresses and delivery of your webhooks continue indefinitely. A deposit nobody sees is a deposit somebody loses, and no billing state is worth causing that.

For your security review

• Transport: mTLS on the Edge↔Cloud gRPC channel. Each frame carries an Ed25519 signature, a timestamp checked against a 300-second window, and a nonce checked for replay.
• Webhooks: HMAC-SHA256 over the raw body bytes.
• Console auth: password plus mandatory TOTP; access token in memory only, refresh token in an httpOnly; SameSite=Strict; Secure cookie. Never localStorage.
• Destructive actions: key rotation, rotation approval and the destructive wipe each require a fresh TOTP code, not merely a live session.
• Tenancy: enforced by explicit query scoping on accountId rather than by an ORM-level filter, so it cannot be bypassed by forgetting to enable one.
• Audit: append-only, enforced by a database trigger rather than by application convention.
• Money: NUMERIC(78,0) in the smallest unit. Nothing parses a monetary value into a floating-point type.

Report a vulnerability to security@ziklagconsulting.com.