{"templateId":"markdown","versions":[{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/identity-and-access/vault-management","default":true,"active":true,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/identity-and-access/vault-management","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/identity-and-access/vault-management","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/identity-and-access/vault-management","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/identity-and-access/vault-management","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/identity-and-access/vault-management","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Vaults","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"vaults","__idx":0},"children":["Vaults"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Executive summary"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Vaults connect ","Ripple Custody"," to the key material used for blockchain transaction signing."]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A vault is an external signing component that securely manages blockchain transaction signing."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The vault uses a KMS, HSM, or MPC backend for blockchain key operations. Other protected components, such as the notary and configured system-signing path, can also use KMS-backed keys."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Vaults are trusted entities and must be registered before accounts can use them."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Accounts in different domains can use the same vault because a vault is not tied to a domain."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Hot vaults sign automatically. Cold vaults are air-gapped and require an export/import workflow."]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"success","name":"Why this matters"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Vault design affects security, transaction processing, account recovery, and day-to-day operations. A vault links governance-approved activity to protected signing keys: policies decide whether a transaction can proceed, and the vault verifies the notary attestation before building and signing the blockchain transaction."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["For architects and operators"]},": Choose the KMS model, key derivation strategy, and hot/cold vault pattern before creating accounts. These choices determine which keys must be backed up, which operational procedures are required, and how quickly transactions can move from approval to broadcast."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Prerequisites"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before reading this page, you should understand:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security-model"},"children":["Security model"]}," - The zero-trust security model and the role of trusted components."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security/cryptographic-trust-model"},"children":["Key management"]}," - How user, notary, vault, and blockchain keys are protected."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/accounts-and-assets/accounts/overview"},"children":["Accounts"]}," - How accounts relate to vaults and ledgers."]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-is-a-vault","__idx":1},"children":["What is a vault?"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A vault is the signing component that connects ","Ripple Custody"," to a KMS, HSM, or MPC backend for blockchain key operations. It is responsible for transaction signing and for interacting with the protected key material behind the vault."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The KMS may be based on:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"KMS model"},"children":["KMS model"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"How keys are protected"},"children":["How keys are protected"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"See"},"children":["See"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["HSM"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A hardware security module generates, stores, and uses private keys internally. Only cryptographic outputs, such as signatures, are exported."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/planning/key-management#hardware-security-modules-hsms"},"children":["Key management planning"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MPC"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Key material is distributed as shards. A threshold of MPC nodes collaborates to produce a signature without reconstructing the complete private key."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/planning/key-management#multi-party-computation-mpc"},"children":["Key management planning"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each time you initialize and register a new vault, specify whether it uses ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["HSM"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["MPC"]},". When the vault is registered, ","Ripple Custody"," stores the vault entity, including its public key, so the system can verify information returned by the vault."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"vaults-in-the-trust-model","__idx":2},"children":["Vaults in the trust model"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["From a data-integrity perspective, the notary and vault are trusted components. The notary signs trusted state, and the vault signs blockchain transactions. The database, API gateway, and other application components are treated as untrusted because trusted data must be verified cryptographically."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart LR\n Intent[\"Approved transaction intent\"]\n Notary[\"Notary / policy evaluation\"]\n Vault[\"Vault\"]\n KMS[\"KMS HSM or MPC\"]\n Chain[\"Blockchain network\"]\n\n Intent -->|\"Policy workflow\"| Notary\n Notary -->|\"Signed attestation\"| Vault\n Vault -->|\"Sign request\"| KMS\n KMS -->|\"Signature only\"| Vault\n Vault -->|\"Signed transaction\"| Chain\n","diagramHtml":"","diagramHtmlDark":""},"children":["flowchart LR\n Intent[\"Approved transaction intent\"]\n Notary[\"Notary / policy evaluation\"]\n Vault[\"Vault\"]\n KMS[\"KMS HSM or MPC\"]\n Chain[\"Blockchain network\"]\n\n Intent -->|\"Policy workflow\"| Notary\n Notary -->|\"Signed attestation\"| Vault\n Vault -->|\"Sign request\"| KMS\n KMS -->|\"Signature only\"| Vault\n Vault -->|\"Signed transaction\"| Chain\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The vault verifies the notary attestation before building and signing a transaction. This keeps signing tied to the approved operation rather than to an unaudited request."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-vaults-relate-to-domains-accounts-and-ledgers","__idx":3},"children":["How vaults relate to domains, accounts, and ledgers"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A vault is not tied to a domain. Accounts in different domains can use the same vault, and each account stores its vault relationship in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["providerDetails.vaultId"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["During account creation, choose:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Account setting"},"children":["Account setting"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Why it matters"},"children":["Why it matters"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Vault ID"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Identifies the vault that stores or derives the account's signing keys."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Key strategy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Determines how account keys are created and what must be backed up."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ledger IDs"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Defines the ledgers associated with the account."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After a vault creation intent is approved and executed, the vault details include ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["supportedDerivations"]},". Use this list when choosing the key strategy for new accounts."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart TD\n subgraph Root[\"Root domain\"]\n VaultEntity[\"Registered vault entity\"]\n end\n\n subgraph DomainA[\"Domain A\"]\n AccountA[\"Account providerDetails.vaultId\"]\n end\n\n subgraph DomainB[\"Domain B\"]\n AccountB[\"Account providerDetails.vaultId\"]\n end\n\n VaultEntity -->|\"Used by\"| AccountA\n VaultEntity -->|\"Used by\"| AccountB\n AccountA -->|\"Ledger IDs\"| LedgerA[\"Blockchain ledgers\"]\n AccountB -->|\"Ledger IDs\"| LedgerB[\"Blockchain ledgers\"]\n","diagramHtml":"","diagramHtmlDark":""},"children":["flowchart TD\n subgraph Root[\"Root domain\"]\n VaultEntity[\"Registered vault entity\"]\n end\n\n subgraph DomainA[\"Domain A\"]\n AccountA[\"Account providerDetails.vaultId\"]\n end\n\n subgraph DomainB[\"Domain B\"]\n AccountB[\"Account providerDetails.vaultId\"]\n end\n\n VaultEntity -->|\"Used by\"| AccountA\n VaultEntity -->|\"Used by\"| AccountB\n AccountA -->|\"Ledger IDs\"| LedgerA[\"Blockchain ledgers\"]\n AccountB -->|\"Ledger IDs\"| LedgerB[\"Blockchain ledgers\"]\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"key-strategies-and-backup-implications","__idx":4},"children":["Key strategies and backup implications"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each vault uses a key strategy that determines how account keys are created and what must be backed up for recovery."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Strategy"},"children":["Strategy"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"How keys are created"},"children":["How keys are created"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Backup implication"},"children":["Backup implication"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Deterministic derivation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Account keys are derived from a master seed using the configured derivation strategy."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The master seed or wrapped seed material is critical to account recovery."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MPC"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Key material is split into MPC shares and protected by the MPC deployment."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["If customer-held MPC backups are required, follow the MPC backup workflow through the operations backup guidance."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Random key strategy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Account keys are generated without a deterministic relationship to a master seed."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The database becomes critical for recovery because accounts cannot be regenerated from a seed backup."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For most new vaults, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VaultHard"]}," is the default key derivation strategy. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["VaultSoft"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Random"]}," require explicit enablement and have additional backup implications."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For the full derivation model, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/accounts-and-assets/accounts/account-key-derivation-and-ledger-compatibility"},"children":["Key derivation"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"hot-and-cold-vaults","__idx":5},"children":["Hot and cold vaults"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Ripple Custody"," supports hot and cold vault transaction-signing flows."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Vault type"},"children":["Vault type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"How signing works"},"children":["How signing works"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Use case"},"children":["Use case"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Hot vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The vault is network-connected and polls for operation queries. After approval, it verifies the notary attestation, builds the transaction, signs it, and submits the signed transaction for broadcast."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Frequent transactions, trading, payments, and operational liquidity."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Cold vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The vault is air-gapped. Operators export pending operations, move them to the cold vault, sign them, and import the signed operations back into ","Ripple Custody","."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Large treasury reserves and cold storage."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Both hot and cold vaults follow the same governance and approval process. They differ in how the vault receives the operation query and returns the signed transaction."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart TD\n Approved[\"Approved transaction intent\"]\n Prepared[\"Notary-attested operation query\"]\n Choice{\"Vault type\"}\n Hot[\"Hot vault polls API and signs\"]\n ColdExport[\"Export pending operations\"]\n ColdSign[\"Cold vault signs offline\"]\n ColdImport[\"Import signed operations\"]\n Broadcast[\"Ledger service broadcasts\"]\n\n Approved --> Prepared --> Choice\n Choice --> Hot --> Broadcast\n Choice --> ColdExport --> ColdSign --> ColdImport --> Broadcast\n","diagramHtml":"","diagramHtmlDark":""},"children":["flowchart TD\n Approved[\"Approved transaction intent\"]\n Prepared[\"Notary-attested operation query\"]\n Choice{\"Vault type\"}\n Hot[\"Hot vault polls API and signs\"]\n ColdExport[\"Export pending operations\"]\n ColdSign[\"Cold vault signs offline\"]\n ColdImport[\"Import signed operations\"]\n Broadcast[\"Ledger service broadcasts\"]\n\n Approved --> Prepared --> Choice\n Choice --> Hot --> Broadcast\n Choice --> ColdExport --> ColdSign --> ColdImport --> Broadcast\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"vault-lifecycle","__idx":6},"children":["Vault lifecycle"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"stateDiagram-v2\n [*] --> Deployed: Deploy vault component\n Deployed --> Registered: v0_CreateVault\n Registered --> UsedByAccounts: Create accounts with vaultId\n UsedByAccounts --> Signing: Approved transactions\n Signing --> Locked: v0_LockVault\n Locked --> UsedByAccounts: v0_UnlockVault\n UsedByAccounts --> Updated: v0_UpdateVault\n Updated --> UsedByAccounts\n","diagramHtml":"","diagramHtmlDark":""},"children":["stateDiagram-v2\n [*] --> Deployed: Deploy vault component\n Deployed --> Registered: v0_CreateVault\n Registered --> UsedByAccounts: Create accounts with vaultId\n UsedByAccounts --> Signing: Approved transactions\n Signing --> Locked: v0_LockVault\n Locked --> UsedByAccounts: v0_UnlockVault\n UsedByAccounts --> Updated: v0_UpdateVault\n Updated --> UsedByAccounts\n"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Lifecycle stage"},"children":["Lifecycle stage"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What happens"},"children":["What happens"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Deploy"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The vault component is deployed with its KMS backend."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Register"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateVault"]}," intent creates the vault entity in ","Ripple Custody",". Vaults are registered from the root domain."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Accounts reference the vault through ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["providerDetails.vaultId"]},"; approved transactions can be prepared for vault signing."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Update"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UpdateVault"]}," intent changes mutable vault details such as alias, description, custom properties, or parameters."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lock or unlock"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_LockVault"]}," prevents transaction orders related to the vault from executing. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_UnlockVault"]}," re-enables the vault."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"backup-recovery-and-key-rotation","__idx":7},"children":["Backup, recovery, and key rotation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Vault strategy affects what operators must preserve for recovery. Platform backup and restore procedures live with operations guidance; vault recovery and wrapping-key rotation procedures live in this section."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Need"},"children":["Need"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Start with"},"children":["Start with"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Determine backup scope"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/operations-and-maintenance/backup-and-restore#what-to-back-up"},"children":["Back up, restore, and recover"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Route operators to the correct backup procedure"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/operations-and-maintenance/backup-and-restore#backup-procedures"},"children":["Backup procedures"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Rotate a vault wrapping key for an IBM HSM-backed vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/vault-management/vault-wrapping-key-rotation-ibm-hsm"},"children":["IBM HSM wrapping key rotation"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Rotate a vault wrapping key for an MPC-backed vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/vault-management/vault-wrapping-key-rotation-mpc"},"children":["MPC wrapping key rotation"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Plan platform-level restore validation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/operations-and-maintenance/backup-and-restore#restore-procedures"},"children":["Restore procedures"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/operations-and-maintenance/backup-and-restore#validation"},"children":["Backup validation"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Recover cold-vault operations after a workstation or environment failure"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/vault-management/cold-vault-recovery"},"children":["Cold vault recovery"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"next-steps","__idx":8},"children":["Next steps"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Task"},"children":["Task"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Page"},"children":["Page"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Register, view, update, lock, or unlock vaults"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/vault-management/manage-vaults"},"children":["Manage vaults"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Understand cold vault operations"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/vault-management/cold-vaults"},"children":["Cold vaults"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Process air-gapped vault operations"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/vault-management/cold-vault-setup-api"},"children":["Process cold vault operations with the API"]}," or ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/vault-management/cold-vault-setup-ui"},"children":["Process cold vault operations in the UI"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Determine backup, recovery, or key-rotation scope"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/vault-management/backup-recovery-and-key-rotation"},"children":["Backup, recovery, and key rotation"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Plan KMS selection"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/planning/key-management"},"children":["Key management planning"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create accounts that use a vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/accounts-and-assets/accounts/manage-accounts-ui"},"children":["Manage accounts in the UI"]}," or ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/accounts-and-assets/accounts/manage-accounts-api"},"children":["with the API"]}]}]}]}]}]}]},"headings":[{"value":"Vaults","id":"vaults","depth":1},{"value":"What is a vault?","id":"what-is-a-vault","depth":2},{"value":"Vaults in the trust model","id":"vaults-in-the-trust-model","depth":2},{"value":"How vaults relate to domains, accounts, and ledgers","id":"how-vaults-relate-to-domains-accounts-and-ledgers","depth":2},{"value":"Key strategies and backup implications","id":"key-strategies-and-backup-implications","depth":2},{"value":"Hot and cold vaults","id":"hot-and-cold-vaults","depth":2},{"value":"Vault lifecycle","id":"vault-lifecycle","depth":2},{"value":"Backup, recovery, and key rotation","id":"backup-recovery-and-key-rotation","depth":2},{"value":"Next steps","id":"next-steps","depth":2}],"frontmatter":{"seo":{"title":"Vaults"}},"lastModified":"2026-08-04T20:25:11.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/identity-and-access/vault-management","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}