> For the complete documentation index, see [llms.txt](https://timechain.gitbook.io/neucron/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://timechain.gitbook.io/neucron/core-concepts/custody-models.md).

# Custody Models

Custody is the answer to one question: **who can sign?** Neucron supports the full spectrum, from fully non-custodial user wallets to institution-grade server-side MPC, all through the same wallet API. You choose the model per wallet at creation time.

## The spectrum

```mermaid
flowchart LR
    A[Non-custodial<br/>user holds 2 of 3 shards] --> B[Co-managed<br/>user + Neucron]
    B --> C[Server-side single-shard<br/>encrypted, API-controlled]
    C --> D[Server-side MPC<br/>shards across your backends,<br/>clouds & vendors]
```

## 1. Non-custodial wallets

The end user holds **2 of the 3 MPC shards**: one on their **device** and one as a **backup shard in their own cloud account**. Neucron holds the third shard as a co-signer for policy enforcement, fraud screening, and recovery support, but can never sign alone.

| Property                  | Value                                                                                  |
| ------------------------- | -------------------------------------------------------------------------------------- |
| Who can move funds        | Only the user (device shard + either backup or Neucron co-sign)                        |
| Neucron unilateral action | Impossible by construction                                                             |
| Device lost               | Recover from cloud backup shard + Neucron shard                                        |
| Cloud account lost        | Recover from device shard + Neucron shard                                              |
| Best for                  | Consumer fintechs, self-custody mandates, jurisdictions requiring non-custodial design |

The user's two shards mean **your company never takes custody**, which materially changes your licensing and compliance posture in most jurisdictions.

## 2. Custodial wallets

Key material is held by Neucron, encrypted at rest. The owner (a user, a business, or your application) authenticates and instructs; Neucron signs. This is the simplest model and the right one when the wallet owner is an organization rather than a person, or when your product experience requires instant, silent transactions.

## 3. Server-side wallets: single-shard encrypted

A server-side wallet with a **single encrypted key shard** held in Neucron's secure backend. It behaves like a hot wallet for a service: your backend (or an [app](https://timechain.gitbook.io/neucron/core-concepts/apps-and-whitelabel), or an [agent](https://timechain.gitbook.io/neucron/core-concepts/agentic-wallets)) calls the API and transactions execute. Use it for operational float, fee wallets, collection addresses, and app-owned wallets where speed matters more than distributed trust.

## 4. Server-side MPC wallets

The institutional model. The wallet is created server-side, but its **MPC shards are distributed across different backend systems, different cloud providers, or different vendor partners**. No single system, cloud, or vendor ever holds enough to sign. Typical layouts:

| Shard layout                                                 | Trust property                                                                 |
| ------------------------------------------------------------ | ------------------------------------------------------------------------------ |
| Your backend + Neucron + second cloud provider               | Survives compromise or outage of any one party                                 |
| Your infrastructure + independent custodian vendor + Neucron | Segregation of duties across organizations, matching institutional risk policy |

Creation is configuration, not custom engineering:

```typescript
const { data } = await sdk.wallet.createWallet({
  walletName: 'Treasury MPC',
  walletType: 'MPC',
  custodianProvider: 'your-custodian',        // optional vendor partner
  customCustodianEndpoint: 'https://...',      // optional external shard endpoint
  businessId: 'biz_abc123',
});
```

## Choosing a model

| Your situation                                | Recommended model                                                                                               |
| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| Consumer app, users must own their funds      | Non-custodial (device + cloud backup shards)                                                                    |
| Business treasury with internal controls      | Server-side MPC + [payout approvals](https://timechain.gitbook.io/neucron/payments/bills-payouts-and-approvals) |
| App-owned operational wallet                  | Server-side single-shard, or MPC if amounts are material                                                        |
| Regulated institution with vendor-risk policy | Server-side MPC across clouds/vendors                                                                           |
| Embedded wallets for your end users at scale  | Non-custodial per-user wallets under your app                                                                   |

{% hint style="warning" %}
Custody is a **per-wallet** decision, not a per-platform one. Most fintechs run several models at once: non-custodial wallets for end users, a server-side MPC treasury, and single-shard operational wallets for apps.
{% endhint %}