iRace Digital (FundBank) · Digital Asset Custody Infrastructure

Self-hosted MPC custody infrastructure for iRace Digital (FundBank)

iRace Digital runs its DFNS MPC signers on its own AWS infrastructure instead of leaving the key shares with the vendor. That gives the bank control of the key material, and makes it responsible for a privileged production estate. HST builds and automates that estate: the account model, the isolation between signers, the key policies, and the delivery pipeline that changes any of it.

The premise

Why a bank self-hosts its signers

In a hosted custody model the vendor holds the key shares. For many firms that is fine. For a bank whose clients’ assets are the business, it puts a third party inside the control boundary the regulator is asking about.
Self-hosting moves that boundary. iRace runs the DFNS signer software and holds every key share in its own infrastructure, and the signing happens on its own signers. DFNS still provides the platform APIs, the policy services, the orchestration, the signer software and support. It no longer holds the shares.
The trade is control in exchange for operating a privileged, stateful and cryptographically sensitive production estate. It has to be provisioned, patched, monitored, backed up and recovered, and none of that can create a route by which one operator, one account or one region could put a signing key back together.
The work is infrastructure, but the disciplines are the same ones HST applies to this bank’s onboarding estate and to its custody record: segregation of duties, evidence that survives inspection, and controls that can be demonstrated rather than asserted. Here they are expressed in key policies and account boundaries instead of in a data model.
Two planes, kept apart. The cryptographic plane (signers, key share databases, KMS keys, certificates and backups) is treated as a separate privileged security domain. The application plane (the custody record, the client channel, reporting) reaches it only through approved vendor APIs. No shared databases, no shared secrets, no shared runtime identities.

The mechanism

How threshold signing works

MPC is not a private key split into pieces that get put back together. The distinction decides what the infrastructure has to protect, so it is worth being precise about.

A value-moving request reaches the vendor's policy layer, which applies the configured policy set, including screening and approval requirements, before any cryptographic work starts. A request that fails policy never reaches a signer.
Every participating signer reads its encrypted key share from its own isolated database. It has no route to any other signer's database, and no credential that would be accepted there.
The share is decrypted through the approved KMS control. The design intent is that the key policy grants decryption only to an attested enclave measurement, so holding an IAM role is not on its own enough to unseal key material.
The threshold number of signers each produce a partial signature, and those are combined into a valid one. No party ever holds, assembles or sees a complete private key, at any point, on any machine, including during recovery. The result comes back through the vendor's APIs. The application plane records the policy, signing and blockchain outcomes and receives no key shares, credentials or database access.
A t-of-n scheme sets how many signers must take part. It also sets the failure modes of the whole estate.
The two choices imply different recovery procedures, different cross-region networking, different backup strategies and possibly a different AWS account layout. Three signers does not by itself mean resilience. Resilience comes from the approved threshold, not the signer count.
So the order of work matters. Until the threshold, the region pairing and the cross-account trust model are approved, only reversible work goes ahead: account factory, central logging, baseline guardrails. Signer clusters, databases, key grants, cross-region networking and recovery configuration wait. Building them early does not save time. It creates rework in the part of the estate where rework is most expensive.

The boundary

Where the application stops and the cryptography begins

Figure 1. The responsibility boundary. The application plane integrates only through approved vendor APIs. The cryptographic plane is a separate privileged domain with per-signer isolation and account-level separation. The crossed path is one that must never exist.

Domain expertise applied

Eight disciplines that all have to hold at once
Custody infrastructure tends to fail at the seams between specialisms. This is the map the work is organised around.
Per-signer isolation as a hard requirement. Each signer has its own workload boundary, encrypted database, KMS key and alias, certificate set and backup path. No signer database is shared with another signer or with any application. Backup access is checked against one question: could a single operator, or a single account, put a signing key back together? The answer has to be no.
The approved threshold and regional distribution have to tolerate the agreed signer or region failure without dropping below the authorised security threshold. Outage scenarios are modelled against the threshold rather than assumed from the number of signers.
An AWS Control Tower and Organizations landing zone, with security and platform services in shared organisational units and KMS accounts separated from signer workload accounts. Application environments sit in their own accounts, separate from signer and KMS accounts.
Dedicated KMS keys with least-privilege key policies per signer, and a Nitro Enclave attestation condition proposed as the gate on decrypting signer material. Validated with the vendor alongside the emergency recovery procedure, since an attestation gate you cannot recover from becomes an outage.
SSM-only access to private VPC, cluster and database resources. Inbound SSH is prohibited. Privileged sessions are recorded, and complete cloud, cluster, key management, database and backup audit evidence is retained.

All infrastructure delivered through Terraform and Terragrunt modules with encrypted remote state, state versioning, locking, drift detection and reviewed plans. Infrastructure security scanning and policy-as-code guardrails block prohibited network, identity, encryption and public-access configurations in the pipeline. Every change has a reviewed forward plan and a recovery plan, and stateful rollback uses tested restore or roll-forward rather than destroy and recreate.

Approved images in a registry with scan-on-push, an SBOM for application and container artifacts, image and release signing, provenance verification at deployment, and promotion blocked on unsigned artifacts or failed integrity checks. CI authenticates to the cloud with short-lived federated credentials, so there are no long-lived deployment keys to leak or rotate.
Documented, access-controlled and tested procedures for key share backup, database restore, certificate replacement, signer replacement and regional recovery, completed before production. Application and data recovery is exercised quarterly, and an end-to-end regional failover exercise including the signing path and vendor participation runs at least every six months and after material architecture change.

Built to be handed over

A custody estate only its builder can operate is a risk rather than an asset. The lifecycle model is agreed before the first cluster exists.

HST DevOps implements the infrastructure as code and the automated lifecycle during delivery. The client’s own Cloud Platform and Operations function owns the cluster control plane, node images, operating system and add-on patching after handover. The vendor confirms signer software compatibility. Who owns what is written down before handover rather than worked out during an incident.
Routine maintenance monthly. Critical security fixes targeted within 72 hours, high severity within 14 days. Supported Kubernetes minor versions adopted within 60 days of vendor compatibility confirmation, so the cluster does not drift into an unsupported version.
Signer software upgrades are decoupled from application deployments. A routine product release cannot carry an unplanned change into the cryptographic plane, and a signer upgrade gets change control that suits it rather than whatever the application pipeline applies.

Engineering judgement

Decisions we do not build past

Most infrastructure programmes lose money on work done early and confidently in the wrong shape. In a cryptographic estate that work is also a security problem. These are the questions treated as hard gates.

Gated until formally approved

Going ahead now, because it is reversible

Highlighted disciplines are used on this engagement. This page covers the custody infrastructure part of that list. The onboarding, financial crime and banking operations work sits in the same practice, with the same team.

The vocabulary we work in

Custody infrastructure terms

person

MPC

Multi-party computation. Several parties jointly compute a result, here a signature, without any of them revealing its input to the others.
solution-raod-map-icon

Key share

One party's secret input to the protocol. It is not a fragment of a private key, and no sequence of operational steps assembles the shares into one.
cloud-1

t-of-n threshold

How many signers (t) must take part out of the total (n). The most consequential parameter in the estate.
companies

Signing ceremony

The coordinated protocol run in which the participating signers each produce a partial signature for one request.
Vector-1-1

Nitro Enclave

An isolated compute environment with no persistent storage, no interactive access and no external networking, used to run the sensitive decryption and signing workload.
iso

Key policy

The rules for who or what may use a key. Conditioning it on an attestation changes the test from holding the right role to being provably the right code.
al-opport-icon

PCR attestation

A cryptographic measurement of exactly what code is running in the enclave, which can be used as a condition on a key policy.
sla

Blast radius

What an attacker reaches after a single compromise. Account boundaries, per-signer keys and isolated databases exist to keep it small.
trams

VASP

Virtual asset service provider. Any institution providing digital asset services. A custodian is the VASP of its clients, and the sending or receiving VASP in a counterparty transfer.
Insurance

Break-glass

The pre-approved, heavily audited emergency path used when normal controls would block legitimate recovery. Designing it is part of designing the control.

Financial services domain expertise

The disciplines behind this work

Our financial services work is organised around the regulated disciplines below rather than around a technology stack. The highlighted ones are used directly on this engagement.

01

Client onboarding &
financial crime

KYC / CDD
Enhanced due diligence
Beneficial ownership
PEP & sanctions screening
AML
Transaction monitoring
KYT / blockchain analytics
Travel Rule
Client lifecycle management
02

Regulatory & tax

FATCA
OECD CRS
MiFID II client categorisation
Record keeping & retention
Audit evidence
Regulatory data architecture
03

Banking operations &
control

Books & records
Position keeping & valuation
End-of-day close
Reconciliation
Four-eyes / maker-checker
Mandate & payment authority
Settlement orchestration
04

Custody & platform
engineering

Custody operating model
Vault & wallet lifecycle
Address whitelisting
Deposit quarantine
Key custody & MPC
Threshold cryptography ops
Cloud landing zone & SRE
Highlighted disciplines are used on this engagement. This page covers the custody infrastructure part of that list. The onboarding, financial crime and banking operations work sits in the same practice, with the same team.

Looking at self-hosted custody?

The hard questions are the ones about threshold, isolation and recovery, and they are much cheaper to answer before the account factory runs. Happy to talk them through.
COMMON QUESTIONS

Frequently asked questions

MPC custody uses Multi-Party Computation (MPC) to distribute control of cryptographic signing across multiple parties or components, reducing reliance on a single private key or signing point.

MPC signer infrastructure provides the systems and operational environment required to securely run MPC-based signing components and support digital asset transactions.

DevOps practices help automate deployment, infrastructure management, monitoring, testing and operational processes around MPC custody infrastructure while maintaining controlled and repeatable releases

MPC custody infrastructure requires strong controls around access, deployment, secrets, monitoring and operational processes because it supports systems involved in digital asset signing.

CI/CD can automate software build, testing and deployment processes, helping teams deliver controlled infrastructure and application changes consistently.

Infrastructure as Code allows infrastructure configuration to be defined and managed through version-controlled code, improving repeatability, traceability and consistency across environments.

Monitoring helps teams observe infrastructure and application behaviour, identify operational issues and support timely investigation and response.

Institutional organisations operating digital asset infrastructure can use MPC custody and DevOps practices to support secure, controlled and scalable digital asset operations.

TESTIMONIALS

HST Solutions is
Truly Committed
To The Clients We Serve.

Book a free call to discuss your ideas with us!
FLEXIBLE ENGAGEMENT MODELS

Find The Perfect Solutions For Your Project

Managed Team

Your product, our dedicated team. From concept to conception, we handle it all.

Staff Augmentation

Need extra hands? Our experts seamlessly join your team, providing the skills you need, when you need them.

Fixed Cost

Upfront price, guaranteed delivery. Your project completed on time and within budget.

    EXPLORE MORE WAYS WE CAN HELP

    Need a Different Approach?

    Compare All Engagement Models

    What is 2 + 7?

    What Makes Us Stand Apart

    We Have Deep
    Technical & Industry Experience

    One Team, One Dream

    At HST, there is no such thing as not my problem.

    Build Trust with Every Interaction

    We’re accountable to our clients and to each other. which means being open even when things aren’t going smoothly.

    Improve Everything

    The world of software and business moves fast so we re always learning and honing our skills.

    Own It

    We are a team of doers and we take responsibility for the success of everything we do.

    Obsessed: Over Results

    We’re obsessed with driving business value for our clients and we know that starts with gaining a deep understanding of the problems they’re facing

    Proven Excellence

    Our word is our bond. With 250+ projects delivered on time and within budget, we’ve built a reputation for keeping every promise.

    Partners in Precision

    Financial services, insurance, healthcare, retail, media. Trust built where excellence is the only option.

    Who Are We ?

    Creativity, Efficiency, & Advanced AI

    Strategy

    We've got all the big ideas and creative talent of an ad agency or creative studio except we deliver working products, not expensive presentations.

    Engineering

    We develop lean, stable code using all the best practices of any leading dev shop, except we focus on the user experience so people actually like using what we build.

    Design

    We validate, design, and prototype proof-of-concepts like any "creative technology" studio, but we do it in less time and for less money.

    Co-paired AI

    Co-paired AI development ensures twice the efficiency at a lower cost. We prioritize your software for innovative, precise, scalable, and quality-assured applications.

    Strategy

    We've got all the big ideas and creative talent of an ad agency or creative studio except we deliver working products, not expensive presentations.

    Engineering

    We develop lean, stable code using all the best practices of any leading dev shop, except we focus on the user experience so people actually like using what we build.

    Design

    We validate, design, and prototype proof-of-concepts like any "creative technology" studio, but we do it in less time and for less money.

    Co-paired AI

    Co-paired AI development ensures twice the efficiency at a lower cost. We prioritize your software for innovative, precise, scalable, and quality-assured applications.