About
Wallet infrastructure that can't betray its users.
Sigcore exists because the industry's answer to key security has been a promise. We wanted it to be a property of the hardware.
Why we built it
Trust the operator was never a good plan.
Every large loss in digital assets over the last decade shares a shape: someone, somewhere, had access they should not have had. An operator, an insider, an attacker who became one. Custodians concentrate that risk. Self-custody pushes it onto users who lose seed phrases.
We spent three years building a platform where the question “who can access the keys?” has a boring answer: nobody. Keys are created inside sealed hardware, used there, and never leave. The software that runs inside is measured and signed, so you can check it is what we say it is.
Sigcore is the first product on that platform: wallets, rules and signing for teams who need institutional-grade custody without running their own hardware security modules or trusting a third party with their users' money.
What we believe
Four principles we don't compromise on.
Non-custodial by construction
Most providers are non-custodial by policy: they promise not to touch your keys. We built a system where touching them is not possible, and where you can verify that for yourself.
Honest about scope
We publish what is implemented and what is still on the roadmap as separate documents. Security buyers deserve to know exactly where the line is.
Verifiable over trusted
Attestation reports, signed receipts and tamper-evident audit logs mean you don't have to take our word for anything. The math does the talking.
Boring on purpose
Signing infrastructure should be the least exciting part of your stack. Fail closed, no surprises, the same answer every time.
The platform
Built on TrustCore.
Sigcore runs on TrustCore, NYXL's confidential-computing platform. TrustCore runs applications inside attested enclaves and refuses to start anything whose release hasn't been signed by a quorum of independent operators. The vault that holds keys, the service that checks your rules and the service that verifies logins all run inside it.
Our architecture, trust boundaries and security tracker are documented in the open. Read them on GitHub, or start with the security overview.
Talk to the people who built it.
Questions about the architecture, a partnership, or a role on the team: we read every message.