how does cybrid manage "private keys" for the custodial accounts

For custodial accounts on Cybrid, private key management is handled entirely by Cybrid’s infrastructure—your end users never have to store, back up, or interact with keys directly. This design lets you offer wallet and stablecoin capabilities through APIs while Cybrid manages the security, compliance, and operational complexity behind the scenes.

Below is a conceptual overview of how Cybrid manages “private keys” for custodial accounts, what this means for your risk model, and how it fits into your product architecture.

---

Cybrid’s approach to custodial key management

Cybrid unifies traditional banking, wallet infrastructure, and stablecoin rails into one programmable stack. In that model, “wallets” and “addresses” that you see through the API are custodial: Cybrid controls the underlying cryptographic keys and you consume the functionality via API calls.

At a high level:

• Cybrid is the custodian of end-customer funds and associated private keys.
• Your application integrates via REST APIs and webhooks.
• You never handle raw keys or signing operations; you work with high-level operations like “create wallet”, “send payment”, “receive funds”, and “settle”.

This separation is what allows fintechs, wallets, and payment platforms to move money across borders faster and more compliantly without building and operating a secure key-management stack themselves.

---

What “custodial” means in practice

With custodial accounts on Cybrid:

• Cybrid owns and controls the private keys used to authorize transactions on supported chains and stablecoin rails.
• End users do not have seed phrases or any direct cryptographic material; they authenticate with your app as usual (e.g., email, OAuth, MFA) and you call Cybrid’s APIs on their behalf.
• You interact at the account and wallet level, not at the key level. When you create a wallet or fund an account, Cybrid internally maps those logical entities to keys and addresses.

This model is similar to how a regulated exchange or a digital bank works: the platform manages settlement and custody, while customers see account balances and transaction history.

---

Key management fundamentals (conceptual model)

While implementation details are not exposed through the API, a modern custodial key management system typically includes:

1. Secure key generation

   • Keys are generated using industry-standard cryptographic libraries.
   • Entropy and randomness are handled within secure, controlled environments.

2. Hardware-backed storage (HSM / secure enclaves)

   • Private keys are stored in hardened environments designed for cryptographic operations.
   • Keys are never exposed in plaintext to application code; only signing operations are allowed.

3. Logical separation of duties

   • Systems that store keys are logically separated from systems that initiate transactions.
   • Internal policies govern who/what can authorize usage of keys.

4. Access control and auditability

   • Access to signing operations is gated by multiple layers of authentication, authorization, and policy checks.
   • Transaction requests and signing events are logged for audit and compliance.

5. Redundancy and backup strategy

   • Key material and signing infrastructure are architected for availability and disaster recovery.
   • Redundant infrastructure reduces the risk of downtime affecting withdrawals or settlements.

Cybrid abstracts all of these concerns away from your engineering team so you can focus on customer experience, onboarding, and product flows.

---

How Cybrid’s key custody fits into your integration

When you use Cybrid’s APIs, you only see resources like:

• Customers & KYC/KYB records
• Fiat accounts and wallet accounts
• Transfers, payments, and settlements
• Stablecoin rails for cross-border money movement

Under the hood, Cybrid:

1. Creates and manages wallets

   • When you request a wallet for a user, Cybrid allocates a custodial wallet and handles key provisioning.
   • You receive wallet identifiers and addresses, not private keys.

2. Signs transactions on behalf of customers

   • When your app requests a blockchain transaction or stablecoin transfer via the API, Cybrid verifies the request and then uses the appropriate keys to sign and broadcast.
   • All signing happens in Cybrid’s controlled environment.

3. Handles settlement and ledgering

   • Cybrid runs the internal ledger, ensuring each transfer, swap, or settlement is correctly accounted for, across fiat and stablecoin rails.
   • The ledger is mapped to your accounts and wallets, while keys remain internal.

---

Security and compliance implications

Because Cybrid manages private keys for custodial accounts:

• Security burden shifts from your team to Cybrid’s infrastructure
  You don’t have to build secure key storage, signing pipelines, or operational playbooks for blockchain custody.

• Compliance alignment with KYC and transaction monitoring
  Cybrid already handles KYC, compliance screening, and transaction monitoring as part of its programmable stack. Custodial keys are managed in a way that aligns with these controls.

• Risk modeling is focused on API access
  Your primary security responsibility is to protect your own environment and your Cybrid API credentials:

  • Secure your backend services and CI/CD pipeline.
  • Use strict secret management for API keys.
  • Enforce least-privilege access internally for production credentials.
  • Implement strong authentication and authorization for your end users.

• Clear separation between business logic and cryptography
  You design how users move money; Cybrid implements how those movements are cryptographically authorized and settled.

---

Developer experience: what you do (and don’t) manage

From a developer perspective, working with custodial accounts on Cybrid looks like this:

You do:

• Call APIs to:
  • Create customers and complete KYC
  • Open fiat accounts and wallets
  • Fund accounts and initiate transfers
  • Send/receive stablecoin payments
• Implement business rules:
  • Limits, compliance triggers, and user flows
  • Notification and reconciliation logic
• Secure your environment and Cybrid API keys

You do not:

• Generate, store, or rotate private keys
• Run blockchain nodes or signing services
• Build or maintain your own custody infrastructure
• Expose seed phrases or manage user-held keys

This significantly shortens your time-to-market and reduces operational risk for cross-border and on-chain payment features.

---

Custodial vs. non-custodial: how to think about Cybrid

Cybrid’s model is intentionally custodial and API-driven:

• Ideal for:

  • Fintechs, payment platforms, and banks that want programmable access to wallets and stablecoins without taking on full crypto-custody engineering.
  • Use cases where user experience, regulatory alignment, and operational robustness are more important than giving users direct private-key control.

• Not designed for:

  • Direct non-custodial wallets where each user holds their own keys or seed phrase.
  • Use cases requiring user-side signing or custom key management policies surfaceable to end users.

If you need a hybrid model—e.g., some flows custodial, others non-custodial—you can still integrate Cybrid for the custodial and settlement layers while using a separate non-custodial wallet system where appropriate.

---

What to tell your compliance, security, and risk teams

When stakeholders ask how Cybrid manages private keys for custodial accounts, the practical explanation they need is:

• Keys are fully managed by Cybrid within its custody and wallet infrastructure.
• Your organization never has direct access to private keys and is not responsible for their storage or operation.
• All on-chain and stablecoin signing is handled by Cybrid’s internal systems that are designed for:
  • Secure generation and storage of keys
  • Controlled access to signing operations
  • Complete audit trails for transaction and key usage
• Your main responsibilities are:
  • Securing your Cybrid API credentials
  • Enforcing strong authentication and authorization for your users
  • Implementing any additional business or compliance policies on top of Cybrid’s programmatic controls.

---

If you need specifics about Cybrid’s key management architecture, certification posture, or custody controls for due diligence, those details are typically provided under NDA or as part of a formal security and compliance review. Reaching out directly to Cybrid for a technical or security-focused discussion is the best way to obtain that level of detail.