sign in
oc · me
§ custody

OrangeCheck holds every role during bring-up, custodian included.

On purpose: the system gets proved before anyone else takes a role in it. Each row is read live, with what replaces it and what flips it.

§ who holds what, today

  • your sign-in key
    you, with a bitcoin wallet · OrangeCheck, with email
    your own wallet · when you sign in with a wallet that signs BIP-322
  • your accrued balance
    OrangeCheck
    nothing has accrued yet · no event bills for real
    a federation of independent guardians, then your own keys · when a federation can be joined and the rail settles into it
  • the paying rail
    nobody yet
    no sats can move
    the federation's own Lightning gateway · when a federation runs its own gateway
  • the key that signs settlements
    OrangeCheck's executor
    a federation's guardian threshold · when settlement moves to a Fedimint federation
  • guardian seats
    no guardian seats yet
    independent operators, in more than one jurisdiction · when a seat's operator key belongs to someone else
  • envelope signing
    OrangeCheck, always
    stays with OrangeCheck — the signature is what you check; a project may co-sign beside it

what you can check yourself

Fetch any envelope's canonical bytes and check its signature, with no help from us. See one verified.

A valid envelope proves a site recorded that it owes you an amount, and that OrangeCheck signed the record. It is not a claim on funds, and there is no solvency proof yet.

where this goes

A federation of independent guardians takes the balance, so no single party, OrangeCheck included, can move it alone. After that, it moves to keys you hold. Graduation to your own keys is not live: no federation is bound yet.

What OrangeCheck stores is on /security; the mechanics are on /how; the protocol shape is at docs.ochk.io/me/custody.