Security is foundational to Utila, it’s at the heart of every decision.
Utila uses a Multi Party Computation protocol executed between Utila and the customer, where each side holds one share of a distributed private key. Both shares stay private and dispersed at all times, so no complete private key ever exists in one place and there is no single point of failure. This is self-custody infrastructure, so you retain control of your assets.
Utila is SOC 2 Type II certified and has its infrastructure audited by Halborn, a leading Web3 security firm. It undergoes rigorous independent audits covering security, availability, and operational integrity, alongside continuous monitoring for real-time oversight. The platform was designed by cybersecurity and cryptography experts, with security built into every layer.
Utila provides a secure offline backup and recovery process for cases of lost or damaged devices or a disaster. Only an approved administrator on your side can recover the keys, which keeps recovery under your control. Institutions that want added redundancy can also use third-party backup providers.
Each key share is uniquely bound to a specific user and device and cannot be used on any other device. Access to key shares is protected by mobile biometrics and passkey-based multi-factor authentication. When a new device joins, it receives existing key shares in an end-to-end encrypted transfer directly from another device, with no server relay.
Outgoing transfers run under policy controls that only a quorum of admins can define and manage, so only authorized users can initiate, approve, and sign transactions. Initiation and signing are separated: a transaction can be initiated in the web Console or through the API, then signed and published on another approved device. Critical policy actions require approval from multiple administrators.