{"templateId":"markdown","versions":[{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/overview/security-model","default":true,"active":true,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/overview/security-model","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/overview/security-model","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/overview/security-model","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/overview/security-model","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/overview/security-model","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Security model","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"security-model","__idx":0},"children":["Security model"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Executive summary"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Ripple Custody"," is built on a zero-trust security model with three pillars: key management, secure communication, and data integrity."]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Your keys stay yours"]},": Private keys never leave your KMS—whether that's an HSM (Hardware Security Module) or an MPC (Multi-Party Computation) cluster. The platform requests signatures without ever seeing the keys themselves."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["No single point of compromise"]},": Even if an attacker breaches the database, API, or network, they cannot steal funds or forge transactions."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Auditable by design"]},": Every state change is signed, timestamped, and stored in a tamper-evident structure."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Resilient to attacks"]},": Multiple layers prevent man-in-the-middle, replay, and database tampering attacks."]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Prerequisites"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before reading this page, you should understand:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/architecture"},"children":["System architecture"]}," - Overview of ","Ripple Custody"," components"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/governance-model"},"children":["Governance model"]}," - How domains, policies, intents, and approvals control operations"]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"success","name":"Why this matters"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Security is the foundation of digital asset custody. Your clients trust you with their assets, and regulators require you to demonstrate robust controls. The zero-trust architecture means you can prove to auditors that no single compromised component can result in asset loss."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["For architects and operators"]},": Understand how the three security pillars work together. Key management protects signing, secure communication protects data in transit, and data integrity protects data at rest. All three must be properly configured for the security model to hold."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["zero-trust model"]}," assumes a hostile network and does not implicitly trust any single component — not even the database. Security is achieved through cryptographic verification, strict component isolation, and explicit, auditable governance."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"the-three-pillars-of-security","__idx":1},"children":["The three pillars of security"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart LR\n subgraph Pillars[\"Security Pillars\"]\n direction TB\n KM[\"Key Management\"]\n SC[\"Secure Communication\"]\n DI[\"Data Integrity\"]\n end\n\n KM --> |\"Keys never exposed\"| Trust[\"Zero Trust
Architecture\"]\n SC --> |\"All traffic verified\"| Trust\n DI --> |\"State is auditable\"| Trust\n","diagramHtml":"

Keys never exposed

All traffic verified

State is auditable

Security Pillars

Key Management

Secure Communication

Data Integrity

Zero Trust
Architecture

","diagramHtmlDark":"

Keys never exposed

All traffic verified

State is auditable

Security Pillars

Key Management

Secure Communication

Data Integrity

Zero Trust
Architecture

"},"children":["flowchart LR\n subgraph Pillars[\"Security Pillars\"]\n direction TB\n KM[\"Key Management\"]\n SC[\"Secure Communication\"]\n DI[\"Data Integrity\"]\n end\n\n KM --> |\"Keys never exposed\"| Trust[\"Zero Trust
Architecture\"]\n SC --> |\"All traffic verified\"| Trust\n DI --> |\"State is auditable\"| Trust\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"1-secure-key-management","__idx":2},"children":["1. Secure key management"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The platform's golden rule is that ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["private keys are never exposed"]},". The vault component acts as a secure gateway to your client-managed _key management system (KMS). The platform performs signing operations without ever seeing the keys."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Method"},"children":["Method"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["HSM (Hardware Security Module)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A tamper-proof physical device that stores the complete private key and performs all cryptographic operations internally."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MPC (Multi-Party Computation)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A cryptographic protocol where the private key is split into multiple \"shards\" held by different parties. No single, complete key ever exists in one place."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For detailed information on key management options and configuration, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security/cryptographic-trust-model"},"children":["Key management"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"2-secure-communication-between-components","__idx":3},"children":["2. Secure communication between components"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The platform assumes all internal network traffic is insecure. Every connection is cryptographically secured through multiple layers:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Layer"},"children":["Layer"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["TLS and PKI"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["All network traffic is encrypted. You provide certificates from your internal PKI (public key infrastructure)."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["JWTs"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["All API requests authenticated using JSON Web Tokens from the platform's OIDC server."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["mTLS"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Critical internal components (notary, vault) use mutual TLS (Transport Layer Security) — both sides verify each other."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Application signing"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Messages between notary and vault are signed at the application layer."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For detailed information on authentication, network security, and the security lifecycle, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security/secure-communication"},"children":["Secure communication"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"3-verifiable-state--governance","__idx":4},"children":["3. Verifiable state & governance"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You cannot trust a system if you cannot verify its state. The platform uses blockchain-inspired cryptographic structures:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Mechanism"},"children":["Mechanism"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Merkle tree"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["All trusted entities organized in a tamper-evident hash tree. Any modification invalidates the signed root."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Anti-rewind file (ARF)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Prevents replay attacks by tracking the most current state version."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Entity signatures"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Every trusted entity is individually signed by the notary. You can ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security/data-integrity-and-audit-trail#verifying-custody-signatures"},"children":["verify these signatures"]}," independently."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For detailed information on data integrity, trusted entities, and the system update flow, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security/data-integrity-and-audit-trail"},"children":["Data integrity and governance"]},"."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"next-steps","__idx":5},"children":["Next steps"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Topic"},"children":["Topic"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security/cryptographic-trust-model"},"children":["Key management"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Deep dive into HSM vs MPC options and key lifecycle"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security/secure-communication"},"children":["Secure communication"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TLS, JWT, mTLS, and application-layer signing"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security/data-integrity-and-audit-trail"},"children":["Data integrity"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Merkle trees, anti-rewind files, and signature verification"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/authentication/overview"},"children":["Authentication"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["How users authenticate and sign requests"]}]}]}]}]}]},"headings":[{"value":"Security model","id":"security-model","depth":1},{"value":"The three pillars of security","id":"the-three-pillars-of-security","depth":2},{"value":"1. Secure key management","id":"1-secure-key-management","depth":3},{"value":"2. Secure communication between components","id":"2-secure-communication-between-components","depth":3},{"value":"3. Verifiable state & governance","id":"3-verifiable-state--governance","depth":3},{"value":"Next steps","id":"next-steps","depth":2}],"frontmatter":{"seo":{"title":"Security model"}},"lastModified":"2026-08-04T20:25:11.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/overview/security-model","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}