Ask for an invitation
Menu

Start

Keeping funds safe

Your wallets are yours. Each needs two of three keys to move anything, and Orrerie holds only one. This page says what that means in practice and what we recommend.

Two of three keys

Each wallet has three keys, and any two can sign:

  • The browser key. It is kept encrypted, and only a passkey of an Owner or Finance member can open it, in a page on merchant.orrerie.com.
  • The recovery key. Your Orrerie app makes it on your phone when the wallets are made, from a one-time code the page shows, and keeps it in the app's own backup words. Only its public part leaves the phone; no web page ever holds it. To replace it while you still have it, the Orrerie app that holds it approves the new one on your phone, from a one-time code the dashboard shows; no backup words are typed on a computer.
  • Orrerie's co-signer. It adds a second signature only to a transaction that already carries yours, after it has rebuilt the same transaction itself and checked your saved addresses and limits.

Orrerie cannot move your money alone, and an API key opens no key at all. Money out describes every step of an approval. The next section says what two of three keys do not cover.

What the keys do not protect

Before a payment arrives, Orrerie's servers decide which address the payer is shown. Your keys protect money once it has arrived, not a payment on its way there. Orrerie makes that decision need two separate parts of its system and watches it from outside. A payment routed by Relay is held by Relay, a separate company, between the payer's payment and its delivery to your wallet. Orrerie never holds it.

A browser is less protected than the Orrerie phone app. For a few seconds in each approval your key is in a web page that Orrerie's server sends. If someone took over that page and Orrerie's co-signer at the same time, they could take the money of every business that approved something while it lasted. Saved addresses, the 24-hour wait on a new address and the limits hold against either one alone.

This is the gap the two keys cannot close for a wallet signed for in a browser. A full break-in of Orrerie's servers, or an insider with both the page and the co-signer, is exactly that case. It would also reach the balance of a Solana or TRON wallet that is not yet activated, even without the co-signer. The downloaded recovery tool is the answer for large amounts: with your browser key backup and your Orrerie app's backup words it moves your money with no hosted page and no co-signer.

Your Orrerie app's backup words are a key. The recovery key is made from the 12 backup words of your Orrerie app, which also restore your own Orrerie wallet. Anyone who has those words and your browser key backup with its password can move the business's money without Orrerie. The one-time code that asks the app for the key belongs to the first app that scans it, so check that your own app shows your business and the same 4 digits as the page before you go on.

A wallet password can be guessed in the browser that already holds the key. After one passkey approval the locked copy of the key is in that browser, and whoever sits at it, unlocked, can keep trying wallet passwords there without asking Orrerie again. Orrerie's count of 5 wrong tries limits new copies, not those guesses. Use a long wallet password, lock your computer, and prefer a passkey that locks the key itself. (A stated limit, accepted on 19 October 2026.)

What we recommend

In one line: keep working balances here; move large holdings with the downloaded tool or to a wallet you hold elsewhere.

  • Keep only working balances in a wallet that is signed for in a browser. A web page cannot be pinned the way an installed app can. Orrerie signs every release of the dashboard, publishes the record in two places and checks the served pages from outside every few minutes, which detects a changed page but cannot prevent one. Keep in these wallets what the business needs day to day.
  • Move a treasury with the downloaded recovery tool. The recovery tool at recover.orrerie.com works with your browser key backup and your Orrerie app's backup words. It uses no hosted page and no co-signer. For a large amount, it is the path we recommend.
  • Use a browser profile with no extensions. Everyone who holds a wallet key should approve in a browser profile kept for that purpose, with no extensions installed. An extension can read and change the pages you open.
  • Save the backup and let the app confirm its key before the first real payment. The dashboard asks for both, and they are what let you move your money without Orrerie. Keep the backup file off your phone.
  • Read the address again before you approve. Malware that swaps a copied address is a common way money is lost. The approval screen shows the saved address with its label and its age.

API keys

Use a restricted key with only the scopes an integration needs, and list the addresses it may call from. Keep keys in the environment of your server, never in code and never in a web page. Roll a key that has been in a URL, a log or a chat.

What Orrerie does on its side

  • Every release of the dashboard is built to the same bytes twice and its list of files is signed with a key the web server never holds.
  • The approval page checks the scripts it is running against the signed record before it opens a key, and refuses with the reason on screen if they differ.
  • The co-signer refuses a release that is not the current or the previous signed one.

The same in brief, without code: How custody works: two of three keys.