Quantum-reliable settlement.
Your keys. Your controls.

Multisig vaults on Bitcoin. Keys SQRL never holds. Fail-closed limits, roles and a write-once audit log. Integrity is quantum-reliable by construction.

Send your questionnaire Request a pilot

secp256k1 today. Quantum-reliable by construction. Vault spends use Bitcoin's curves. Ledger integrity rests on hash commitments. SQRL endpoints are built to run NIST-standardised post-quantum cryptography.

Request, sign, finalise, broadcast

Cryptography, layer by layer

Endpoints

NIST-standardised PQ on attestations, transport and wallet.

SQRL ledger

Hash commitments. Integrity is replay against hashes.

Lightning

Instant off-chain. Hub requests signatures only.

Bitcoin

Settlement and ordering. Single-use keys; Taproot ready.

Endpoints run

Post-quantum, NIST-standardised

ML-KEMFIPS 203

Transport

ML-DSAFIPS 204

Attestations

SLH-DSAFIPS 205

Long-lived roots

Hybrid with classical where needed. A staged profile, not a flag-day cutover.

secp256k1 today

Curves Bitcoin already trusts.

Hash integrity

Replay against commitments.

NIST PQ endpoints

ML-KEM, ML-DSA, SLH-DSA.

Bitcoin path

Single-use keys; Taproot ready.

Your subnet. Your keys. Host with SQRL or on-premise. Keys, customers and records stay inside. The hub sees amount, currencies and receiving subnet only.

Your subnetTrust boundary

Closed deployment

Keys

You sign every outbound payment

Validators

Member quorum attests state roots

Registry

Your own contract registry

State

Full ledger held by members

Customers

Never leave the subnet

Channels

Lightning under your keys

Members hold full state. Outsiders see Bitcoin-anchored commitments only.

Outside the boundary

Hub sees only

Amount250,000.00

CurrenciesUSD to EUR

Receiving subnetBank in Europe

Hub can request signatures. It cannot produce them.

Outside the boundary

Canonical ledger

Subnet registry

Checkpoints

Shared asset layer

You sign outbound

Hub cannot produce signatures.

Liquidity yours

Channels under your keys.

Canonical standing

Checkpoints unlock routing.

Every movement follows one path. Same steps every time. Nothing reaches Bitcoin until your vault's quorum has signed.

01
Role starts it
Needs Initiate payment in that workspace.
02
Limits checked first
Fail closed; address book only.
03
Each signer signs
On device; signing is approval.

Quorum in the vault

P2WSH M-of-N in Bitcoin script.

vault.descriptorBitcoin mainnet

1// Treasury reserve, 2 of 3
2wsh(multi(2,
3  xpub6CUGRUonZSQ4TWtT…,
4  xpub6D4BDPcP2GT577Vv…,
5  xpub6FHa3pjLCk84BayL…
6))
7 
8// A spend with fewer than two
9// signatures is not valid on
10// Bitcoin.

05
Last signature broadcasts
Finalised, then sent; cannot recall.

vault.descriptorBitcoin mainnet

1// Treasury reserve, 2 of 3
2wsh(multi(2,
3  xpub6CUGRUonZSQ4TWtT…,
4  xpub6D4BDPcP2GT577Vv…,
5  xpub6FHa3pjLCk84BayL…
6))
7 
8// A spend with fewer than two
9// signatures is not valid on
10// Bitcoin.

Your private keys never reach SQRL. SQRL stores public keys only. A public key cannot sign.

Trezor

Sign on device.

Software profile

Phrase stays in the browser.

Signing service

Requests only; holds no key.

signer_key.jsonWhat SQRL stores

1{
2  "key_type": "hd_xpub",
3  "xpub": "xpub6CUGRUonZSQ4TWtTMmzX…",
4  "master_fingerprint": "73c5da0a",
5  "derivation_base_path": "m/84'/0'/0'",
6  "net": "mainnet",
7  "status": "active"
8}
9 
10// The keys table has no column for
11// a private key or a recovery phrase.

Limits refuse until you set them. Your team sets the rules. Every check is logged.

Spending limits fail closed.

Set vault and role limits. Unset means refuse. Over limit means refuse.

Address book

Named destinations only.

Whitelist

Approved holders only.

Pause

Halts transfers when needed.

One workspace at a time. Mainnet or sandbox. Invite by email. Role sets what they can do.

Eleven permissions

From Initiate to View logs.

Starter roles

Owner, Admin, Initiator.

Sign-in

Email code or Google.

Every action lands in the audit log. Ten categories. Filter with View logs.

Audit Logs

Workspace: Treasury · Mainnet

Export CSV

TimestampCategoryActionDescriptionUser

30 Oct 2026, 14:10:27PolicyPolicy › Check › AllowedVault transaction of 120,000 approved against spending policy; 3,370,000 of 5,000,000 cycle limit now usedTreasury lead

30 Oct 2026, 14:06:52BitcoinBtc › Tx › BroadcastedWallet 'Treasury operating' transaction broadcast to the Bitcoin network; txid 892dd30a…Finance director

30 Oct 2026, 14:06:51SigningSign › Quorum › SatisfiedM-of-N signing quorum satisfied for wallet 'Treasury operating'; PSBT auto-finalised and ready to broadcastFinance director

30 Oct 2026, 13:41:09PolicyPolicy › Check › AllowedVault transaction of 250,000 approved against spending policy; 3,250,000 of 5,000,000 cycle limit now usedTreasury lead

30 Oct 2026, 11:12:40PolicyPolicy › Check › DeniedRole transaction of 1,200,000 denied; would exceed the requester's role cycle limit 1,000,000Treasury lead

30 Oct 2026, 09:03:22Audit ExportAudit › Export › RequestedAudit log export initiatedRisk officer

30 Oct 2026, 08:51:14SigningSign › Quorum › SatisfiedM-of-N signing quorum satisfied for wallet 'Treasury reserve'; PSBT auto-finalised and ready to broadcastRisk officer

Policy › Check › AllowedPolicy

30 Oct 2026, 14:10:27 · Treasury lead

Btc › Tx › BroadcastedBitcoin

30 Oct 2026, 14:06:52 · Finance director

Sign › Quorum › SatisfiedSigning

30 Oct 2026, 14:06:51 · Finance director

Policy › Check › AllowedPolicy

30 Oct 2026, 13:41:09 · Treasury lead

Policy › Check › DeniedPolicy

30 Oct 2026, 11:12:40 · Treasury lead

Audit › Export › RequestedAudit Export

30 Oct 2026, 09:03:22 · Risk officer

Sign › Quorum › SatisfiedSigning

30 Oct 2026, 08:51:14 · Risk officer

Written once

Same ID inserts once.

Malformed kept

Invalid events stored aside.

Exports logged

CSV export is recorded.

Instant on Lightning. Final on Bitcoin. HTLC: every hop or none. Channels open and close on Bitcoin. Balances return under your keys.

Lightning

Instant on Lightning

Seconds, off-chain

Subnet A

Your hub

HTLC

Payment hash

AMM hub

In-flight FX

HTLC

Same hash

Subnet B

Receiving hub

Completes at every hop or at none. In-flight FX settles under the same payment hash.

Bitcoin

Final on Bitcoin

Conventional depths 30–60 min

Channel open / close

Batch net settle

~30 min

Confirmed

~60 min

Wholesale final settlement within about an hour compares favourably with T+2. Force-close without the hub; balances return under your keys.

Atomic HTLC

Every hop or none.

In-flight FX

Same payment hash.

Bitcoin finality

Confirm, then settle.

Questions security teams ask. Keys, quorum, custody, quantum-reliable.

Send your questionnaire

You do; SQRL stores public keys only.

In Bitcoin script on the vault (P2WSH M-of-N).

No; it can request signatures, not produce them.

Integrity is quantum-reliable by construction; SQRL endpoints are built to run NIST-standardised PQ in a staged profile.

Built for diligence. Controls are open before a pilot. Licence obligations cover material cyber incidents.

Questionnaire

Control-by-control answers for security, risk and compliance before a pilot.

Send your questionnaire

Controls map

Keys, limits, roles, whitelist, pause and the movement path on one page.

This Security page

Audit export

Insert-once log across ten categories. CSV export is itself recorded in the log.

View logs permission

Independent code and protocol audits, and pen tests, are shared under NDA when available.

Send us your security questionnaire.

We answer control by control.

Send your questionnaire

Quantum-reliable settlement. Your keys. Your controls.

secp256k1 today. Quantum-reliable by construction. Vault spends use Bitcoin's curves. Ledger integrity rests on hash commitments. SQRL endpoints are built to run NIST-standardised post-quantum cryptography.

secp256k1 today

Hash integrity

NIST PQ endpoints

Bitcoin path

Your subnet. Your keys. Host with SQRL or on-premise. Keys, customers and records stay inside. The hub sees amount, currencies and receiving subnet only.

You sign outbound

Liquidity yours

Canonical standing

Every movement follows one path. Same steps every time. Nothing reaches Bitcoin until your vault's quorum has signed.

Role starts it

Limits checked first

Each signer signs

Quorum in the vault

Last signature broadcasts

Your private keys never reach SQRL. SQRL stores public keys only. A public key cannot sign.

Trezor

Software profile

Signing service

Limits refuse until you set them. Your team sets the rules. Every check is logged.

Spending limits fail closed.

Address book

Whitelist

Pause

One workspace at a time. Mainnet or sandbox. Invite by email. Role sets what they can do.

Eleven permissions

Starter roles

Sign-in

Every action lands in the audit log. Ten categories. Filter with View logs.

Written once

Malformed kept

Exports logged

Instant on Lightning. Final on Bitcoin. HTLC: every hop or none. Channels open and close on Bitcoin. Balances return under your keys.

Atomic HTLC

In-flight FX

Bitcoin finality

Questions security teams ask. Keys, quorum, custody, quantum-reliable.

Built for diligence. Controls are open before a pilot. Licence obligations cover material cyber incidents.

Questionnaire

Controls map

Audit export

Send us your security questionnaire.

Quantum-reliable settlement.
Your keys. Your controls.