The seed is created in the ceramic. No third party takes part in that moment.
Air-gapped signing · Live monitoring
Keys that never
touch the wire.
Halcyon keeps the signature inside the ceramic and the risk on a desk you can see. The seed does not go online. Review, watch, and trace run on another table.
- Open for review
- Seed stays offline
- The screen is the check
Ceramic bodyE-ink confirmCopper detentAir gap
OpenReviewnot trust
FIG. 01 — Key One
4,812Codebases read
63,400Findings closed
41Networks watched
186,000Address labels
Studio figures for this page. Illustrative, not an audit attestation.
Custody
You have the login. The power sits elsewhere.
An exchange holds the seed. A hot wallet leaves it on a machine that faces the network. One freeze, one breach, one blind signature, and the assets were never only yours.
If you cannot read it on the e-ink window, it should not be signed.
The device can disappear. Recovery belongs to the backup you keep, not to our servers.
Lattice watches chains and systems. It never asks the key to come online.
The desk
One language for the whole stack.
Slow where it matters. The review is written, scoped, and signed by a person.
01
Exchange review
Custody design, withdrawal logic, and the private-key path. Not only the website edge.
02
Wallet review
Signing flow, backup handling, and every place a seed can leak onto a networked machine.
03
Chain review
Client configuration, consensus edges, and the virtual machine that actually runs the rules.
04
Contract review
A source reading of token, vault, and application contracts before they are immutable.
05
Red team
A scoped look across people, vendors, and systems. Written up. Time-boxed. No spectacle.
06
Continuous watch
What a single report cannot see next month, kept under a living monitor.
07
Threat intelligence
Signals from partners and public incidents, folded into one desk.
08
Defense deploy
Hot-desk hardening fitted to the room you operate, not a generic checklist.
09
Response
A calm sequence for the hour after something breaks: contain, explain, recover.
10
Trace
Follow a public trail of moved assets and name the desks that touched them.
11
Labels
Address labels and notes shaped for compliance teams, set to their policy.
12
Second pass
A reread of diffs and findings. A person still signs the report.
Hardware
Key One
A pocket signer. Matte ceramic, one copper detent, an e-ink window large enough to read the action and small enough to keep in a coat.
- BodyCeramic slab, copper ring
- ConfirmE-ink, on the device
- BackupYours, kept offline
- LinkQR or cable. The key stays in.
Signing room
Key Studio
The same rule, a larger window, meant for a desk where more than one person must see the hash before the button moves.
The other desk
Lattice
A live picture of code, exposures, and chains. Scores move. The signer never joins this screen.
Ritual
Four moves. Then a signature.
01
Create
The device makes the seed. You write the backup. We never see it.
02
Read
The window lists what will happen. You compare it with the request.
03
Sign
The copper button confirms only what the window showed.
04
Watch
Lattice keeps the rest of the desk in view, without the key.
Trace
A public trail, named calmly.
When assets move in the open, Trace lines up the hops and the desks that touched them. This strip is a sample, not a live case.
01Hot deskSample
02BridgeSample
03Unlabeled clusterSample
04Named venueSample
Review room
What the desk is asked to hold.
Composite notes from the work. Not endorsements, and not quotes from other firms.
Show me the withdrawal path, not the homepage.
If the screen and the request disagree, we stop.
A report that nobody rereads is a brochure.
Questions
Asked on the way in.
If the device is lost, are the assets gone?
No. The assets sit on the network. The backup you wrote during setup restores the key onto a new Halcyon device. Keep that backup offline, and never type it into a website.
Will Halcyon ever ask for the seed phrase?
No. Not in a form, not in email, not in a chat. Anyone who asks for the seed is not this desk.
Is a large exchange enough?
An exchange can be careful and still be the holder of the key. Halcyon is for the moment you want that power on your side of the table.
Can the key still reach on-chain apps?
Yes. You connect, you read the action on the device, and you sign there. The private key does not leave the ceramic.
What does a review include?
A written scope, the systems in that scope, findings with severity, and a person who will walk the report with you. It is not a badge pasted on a homepage.
Where does this website send my note?
Nowhere. The language choice and the note stay in this browser. From the desk form you can copy the note or open it in your mail app.
The next hour
Bring the scope. Leave the seed.
Tell us what you want read: an exchange desk, a wallet, a contract, or an incident already in motion. Do not include keys, phrases, or customer data.