Bitcoin custody formore than one person.

Read the threat model
Open sourceSelf-hostable
The SigVault dashboard — active vaults, connected signing devices, pending signatures, and the bitcoin price
Live on testnet & signet

Mainnet is not open yet. SigVault is young software that will handle real money. We publish our threat model, our trust boundaries, and our limitations — read them before you deposit.

Signers can be anywhere.

A hardware wallet on someone's desk, a service signing through the SDK — one session collects from all of them. Partial signatures relay through the coordinator, which can do nothing with them until the threshold is met.

Ceremony · escrow.policy

Send 2.40000000 BTC

to bc1q…7m4k · fee 4.2 sat/vB

Signers0 of 3 collected
Reviewed on the device screenColdcard
Partial signature relayedpsbt
Declined by the signer12:07:41
No signature produced—
Signed programmaticallysign.py
Partial signature relayedpsbt
Threshold · 2 of 3collecting

The seller refused. Two of three is still a quorum, so the escrow settles without them — and would not have settled with the arbiter alone.

sigvault desktopconnected · jade
Verify on your device
Amount
2.40000000 BTC
To
bc1q…7m4k
From
Escrow · acme × borden
Confirm the address on your Jade's screen

The private key never leaves the device. SigVault sees the signature, never the key that made it.

Write the rule.
Not the workaround.

A quorum, a recovery path, and a timelock — composed in the builder and compiled straight to a descriptor. Pick a scenario to see the shape it produces.

Spending paths
Operating path2 of 3
Acme Holdings Ltd · CFOColdcard
Acme Treasury BV · ControllerBitBox02
Kessler & Vance LLP · auditorJade

Any two of the three entities can spend. The CFO and the controller sit in different legal entities, so a single compromised office is never a quorum.

Board recovery3 of 4~6 months
Board · chairColdcard
Board · seat 2Trezor
Board · seat 3Ledger
Board · seat 4BitBox02

If the operating quorum is lost, four named board members can recover — but only after the timelock, and only three of them together.

Compiled descriptorTaproot (P2TR)

tr(unspendable,{multi_a(2,K_cfo,K_controller,K_auditor),and_v(v:older(26280),multi_a(3,K_b1,K_b2,K_b3,K_b4))})

Every path on the left compiles into this one expression. It is what the network checks at spend time — nothing outside it can move the funds, including us.

Read the walk-through

Bring the device
you already trust.

Combine devices from different vendors in a single multi-party vault.

Ledger
Jade
BitBox02
Trezor
Coldcard
Specter DIY

Free

$0forever

Get started with basic vault management.

  • 1 wallet
  • 2-of-3 multisig
  • 3 signing devices
  • Community support
  • Standard transaction broadcasting
Get Started
Most popular

Holder

$29/month

For serious Bitcoiners securing significant holdings.

  • Unlimited wallets
  • Custom quorum policies
  • Unlimited signing devices
  • Priority support
  • Time-lock recovery paths
  • Transaction batching
  • PSBT export & import
Start Free Trial

Enterprise

Custom

For organizations managing Bitcoin treasury.

  • Everything in Holder
  • Dedicated infrastructure
  • Custom spending policies
  • Audit trail & compliance
  • Multi-team access controls
  • SLA & dedicated support
  • On-premise deployment option
Contact Sales

Self-hosting is free on every tier. Pair your own wallet service and the coordinator becomes something you run, not something you subscribe to.

Compare plans in full

Artifacts you can check.

Reproducible buildsnot yet
Independent security auditnot yet

Try a signet or testnet vault first.

Create a free vault, connect the hardware wallet you already own, and run a signing ceremony with someone you trust. Ten minutes. No card.