{"templateId":"markdown","versions":[{"version":"v1.43","label":"v1.43 LTS","link":"/products/custody/identity-and-access/vault-management/cold-vaults","default":true,"active":false,"folderId":"c15a2701"},{"version":"v1.42","label":"v1.42 STS","link":"/products/custody/v1.42/identity-and-access/vault-management/cold-vaults","default":false,"active":true,"folderId":"c15a2701"},{"version":"v1.41","label":"v1.41 STS","link":"/products/custody/v1.41/identity-and-access/vault-management/cold-vaults","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/identity-and-access/vault-management/cold-vaults","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/identity-and-access/vault-management/cold-vaults","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/identity-and-access/vault-management/cold-vaults","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/identity-and-access/vault-management/cold-vaults","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Cold vaults","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"cold-vaults","__idx":0},"children":["Cold vaults"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Executive summary"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Cold vaults isolate the signing environment from network-connected systems."]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Cold vault signing uses the same governance approval model as hot vault signing."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The difference is transport: operations move between the online system and the air-gapped workstation as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," files."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A cold bridge runs on the air-gapped workstation and provides the local interface that the vault polls for signing work."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Accounts, transactions, and manifests created for a cold vault remain ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Pending"]}," until the signed payload is imported back into ","Ripple Custody","."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Cold vault operations trade speed and automation for stronger physical isolation."]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"success","name":"Why this matters"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Cold storage reduces the attack surface for high-value assets because the signing environment is not reachable from the online deployment. Even if an online component is compromised, the attacker still cannot directly reach the cold vault signing environment."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["For architects and operators"]},": Cold vaults require operational discipline. You need an air-gapped workstation, controlled transfer media, clear verification steps before signing, and recovery procedures for the workstation, vault configuration, and KMS material."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Prerequisites"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before using cold vaults, you should understand:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.42/identity-and-access/vault-management"},"children":["Vaults"]}," - How vaults relate to KMS, accounts, and governance-approved signing."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.42/transactions/processing"},"children":["Transaction processing"]}," - How approved transactions move to signing and broadcast."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.42/deployment/planning/key-management"},"children":["Key management planning"]}," - How KMS choices affect signing and recovery."]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"cold-vault-architecture","__idx":1},"children":["Cold vault architecture"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A cold vault uses a physically isolated signing environment. The online deployment prepares operation payloads, an operator transfers those payloads to the air-gapped workstation, the cold bridge makes the payload available to the local vault, and the signed result is transferred back for import."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart LR\n subgraph Online[\"Online Ripple Custody environment\"]\n UI[\"UI or API\"]\n Core[\"Core services\"]\n end\n\n subgraph Transfer[\"Manual transfer\"]\n DatOut[\"Unsigned .dat file\"]\n DatIn[\"Signed .dat file\"]\n end\n\n subgraph Cold[\"Air-gapped workstation\"]\n Bridge[\"Cold bridge\"]\n Vault[\"Vault\"]\n KMS[\"KMS
HSM or MPC\"]\n Bridge --> Vault --> KMS\n end\n\n UI --> Core\n Core --> DatOut --> Bridge\n Bridge --> DatIn --> Core\n","diagramHtml":"

Air-gapped workstation

Manual transfer

Online Ripple Custody environment

UI or API

Core services

Unsigned .dat file

Signed .dat file

Cold bridge

Vault

KMS
HSM or MPC

","diagramHtmlDark":"

Air-gapped workstation

Manual transfer

Online Ripple Custody environment

UI or API

Core services

Unsigned .dat file

Signed .dat file

Cold bridge

Vault

KMS
HSM or MPC

"},"children":["flowchart LR\n subgraph Online[\"Online Ripple Custody environment\"]\n UI[\"UI or API\"]\n Core[\"Core services\"]\n end\n\n subgraph Transfer[\"Manual transfer\"]\n DatOut[\"Unsigned .dat file\"]\n DatIn[\"Signed .dat file\"]\n end\n\n subgraph Cold[\"Air-gapped workstation\"]\n Bridge[\"Cold bridge\"]\n Vault[\"Vault\"]\n KMS[\"KMS
HSM or MPC\"]\n Bridge --> Vault --> KMS\n end\n\n UI --> Core\n Core --> DatOut --> Bridge\n Bridge --> DatIn --> Core\n"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Component"},"children":["Component"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Role"},"children":["Role"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Online ","Ripple Custody"," environment"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Creates accounts, transactions, and manifests as governed operations. Exports pending cold vault operations."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Transfer media"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Moves ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," payloads between the online environment and the air-gapped workstation."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Cold bridge"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Runs on the air-gapped workstation. Provides the local UI and API used to upload, inspect, sign, and download operation payloads."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Polls the cold bridge for signing work, verifies the notary attestation, builds the transaction, and signs."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["KMS"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Protects the signing key material and performs cryptographic operations."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"hot-vaults-and-cold-vaults","__idx":2},"children":["Hot vaults and cold vaults"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Both vault types follow the same governance and approval process. They differ after the operation is prepared for vault signing."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Factor"},"children":["Factor"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Hot vault"},"children":["Hot vault"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cold vault"},"children":["Cold vault"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Connectivity"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Network-connected."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Air-gapped."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Signing path"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Vault polls the online API for operation queries."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Vault polls the local cold bridge for operation queries."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Operator involvement"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Automated after approval."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Manual export, transfer, signing, and import."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Typical use"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Frequent transactions, payments, and operational liquidity."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["High-value reserves and cold storage."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"signing-workflow","__idx":3},"children":["Signing workflow"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n participant User as User\n participant Online as Online system\n participant Media as Transfer media\n participant Bridge as Cold bridge\n participant Vault as Vault\n\n User->>Online: Submit and approve operation\n Online->>Online: Prepare cold vault operation\n Online->>Media: Export unsigned .dat file\n Media->>Bridge: Transfer to air-gapped workstation\n Bridge->>Vault: Vault polls for signing work\n Vault->>Vault: Verify notary attestation and sign\n Vault->>Bridge: Return signed payload\n Bridge->>Media: Download signed .dat file\n Media->>Online: Import signed operations\n Online->>User: Continue account, transaction, or manifest processing\n","diagramHtml":"VaultCold bridgeTransfer mediaOnline systemUserVaultCold bridgeTransfer mediaOnline systemUserSubmit and approve operationPrepare cold vault operationExport unsigned .dat fileTransfer to air-gapped workstationVault polls for signing workVerify notary attestation and signReturn signed payloadDownload signed .dat fileImport signed operationsContinue account, transaction, or manifest processing","diagramHtmlDark":"VaultCold bridgeTransfer mediaOnline systemUserVaultCold bridgeTransfer mediaOnline systemUserSubmit and approve operationPrepare cold vault operationExport unsigned .dat fileTransfer to air-gapped workstationVault polls for signing workVerify notary attestation and signReturn signed payloadDownload signed .dat fileImport signed operationsContinue account, transaction, or manifest processing"},"children":["sequenceDiagram\n participant User as User\n participant Online as Online system\n participant Media as Transfer media\n participant Bridge as Cold bridge\n participant Vault as Vault\n\n User->>Online: Submit and approve operation\n Online->>Online: Prepare cold vault operation\n Online->>Media: Export unsigned .dat file\n Media->>Bridge: Transfer to air-gapped workstation\n Bridge->>Vault: Vault polls for signing work\n Vault->>Vault: Verify notary attestation and sign\n Vault->>Bridge: Return signed payload\n Bridge->>Media: Download signed .dat file\n Media->>Online: Import signed operations\n Online->>User: Continue account, transaction, or manifest processing\n"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Solana"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Solana transactions reference a recent blockhash that expires before a cold vault round trip completes. To sign Solana transactions from a cold vault, you need a durable nonce account owned by the cold vault account. A hot vault account can create one and delegate its nonce authority to the cold vault account. After that one-time setup, the cold vault signs Solana transactions without the hot vault. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.42/accounts-and-assets/accounts/ledger-specific-settings/solana-api"},"children":["Set up Solana durable nonce accounts"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"first-time-cold-vault-handshake","__idx":4},"children":["First-time cold vault handshake"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When a cold vault is first registered, it can appear in a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Pending"]}," state because it cannot automatically connect to the online deployment. Complete the manual handshake before using the vault for accounts, transactions, or manifests."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["At a high level:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Register the cold vault using the standard vault registration flow."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Download the vault data from the cold bridge on the air-gapped workstation."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Transfer the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," file to the online environment."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Import the file into ","Ripple Custody","."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify that the vault status is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Completed"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For steps, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.42/identity-and-access/vault-management/cold-vault-setup-ui#complete-the-first-time-vault-handshake"},"children":["Process cold vault operations in the UI"]}," or ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.42/identity-and-access/vault-management/cold-vault-setup-api#complete-the-first-time-vault-handshake"},"children":["Process cold vault operations with the API"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"operational-responsibilities","__idx":5},"children":["Operational responsibilities"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Responsibility"},"children":["Responsibility"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Why it matters"},"children":["Why it matters"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Air-gap controls"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The workstation must remain isolated from networks so signing cannot be reached remotely."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Transfer media controls"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," files move between the online environment and the air-gapped workstation. Use approved media and handling procedures."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Payload verification"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Operators should inspect operation details before allowing the cold vault to sign."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["KMS recovery"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Cold vault recovery depends on protected KMS material and vendor recovery procedures."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Configuration backup"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Recovery requires the same vault configuration, including the vault UUID and public key."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"next-steps","__idx":6},"children":["Next steps"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Task"},"children":["Task"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Page"},"children":["Page"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Plan the air-gapped workstation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.42/deployment/planning/cold-vault-workstation"},"children":["Cold vault workstation planning"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Deploy the cold bridge"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.42/deployment/install/cold-bridge-deployment"},"children":["Deploy a cold bridge"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Register, view, update, lock, or unlock vaults"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.42/identity-and-access/vault-management/manage-vaults"},"children":["Manage vaults"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Process cold vault operations in the UI"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.42/identity-and-access/vault-management/cold-vault-setup-ui"},"children":["Process cold vault operations in the UI"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Process cold vault operations with the API"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.42/identity-and-access/vault-management/cold-vault-setup-api"},"children":["Process cold vault operations with the API"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Recover cold vault operations after workstation loss"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.42/identity-and-access/vault-management/cold-vault-recovery"},"children":["Recover a cold vault"]}]}]}]}]}]}]},"headings":[{"value":"Cold vaults","id":"cold-vaults","depth":1},{"value":"Cold vault architecture","id":"cold-vault-architecture","depth":2},{"value":"Hot vaults and cold vaults","id":"hot-vaults-and-cold-vaults","depth":2},{"value":"Signing workflow","id":"signing-workflow","depth":2},{"value":"First-time cold vault handshake","id":"first-time-cold-vault-handshake","depth":2},{"value":"Operational responsibilities","id":"operational-responsibilities","depth":2},{"value":"Next steps","id":"next-steps","depth":2}],"frontmatter":{"seo":{"title":"Cold vaults"}},"lastModified":"2026-10-23T14:40:24.033Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/v1.42/identity-and-access/vault-management/cold-vaults","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}