# Security > Fiber is designed so that no single ordinary server holds everything required to move your assets. Wallet key material is divided across separate security boundaries, and transactions require explicit user authorization. This allows Fiber to simplify wallet access and transaction flows without operating like a traditional custodian. ![Two separated key fragments across distinct security boundaries join only for an authorized signing action](https://docs.fiber.so/images/fiber-security-architecture.webp) _Key shares stay across separate boundaries. User authorization is the bridge to a signature._ ## Key Architecture A private key gives a wallet the authority to approve transactions. Storing the complete key in one place would create a single point of failure. Fiber uses Shamir’s Secret Sharing, or SSS, to divide wallet key material into separate encrypted shares. These shares are stored across different security boundaries and cloud environments, including: - A share held by Fiber’s API infrastructure - A share protected inside an internet-restricted secure enclave - Separate systems responsible for account access and transaction authorization A secure enclave is an isolated computing environment designed to protect sensitive operations from the wider system around it. No single ordinary server should have enough information to reconstruct the wallet’s spending authority by itself. ## User Authorization Key shares only come together for an authorized signing action. When a transaction requires a wallet signature, the user must approve it through the supported authorization process. Fiber’s systems may prepare and coordinate the transaction, but they are designed not to independently create or approve an action outside that process. Fiber is not designed to: - Move assets without user authorization - Create a transfer the user did not approve - Independently initiate wallet actions - Hold a conventional custodial key with unrestricted spending authority This separation allows Fiber to manage the wallet experience without taking custody of the underlying assets. ## What This Security Model Provides Fiber’s architecture is designed to provide: - Reduced exposure from a single compromised server - Separation of key material across independent security boundaries - Secure-enclave protection for sensitive signing operations - Explicit user authorization for wallet transactions - Familiar account access and recovery without relying on a traditional seed phrase - A simpler wallet experience without turning Fiber into an exchange-style custodian The underlying infrastructure may evolve, but the core principle remains the same: Fiber should not be able to independently move user assets. ## What This Security Model Does Not Prevent Key separation and enclave-based security do not remove every risk. They do not guarantee protection from: - A compromised email account, phone number, or device - Phishing, impersonation, or malicious links - Approving the wrong transaction - Sending assets to an incorrect address or network - Vulnerabilities in an underlying protocol or smart contract - Market, liquidity, issuer, or asset risk - Every possible infrastructure or software failure Non-custodial security changes where responsibility and risk sit; it does not eliminate them. ## Protecting Your Account Users should: - Secure their email address, phone number, and devices - Enable biometric authentication and other supported protections - Never share verification codes or login credentials - Review transaction details before approval - Confirm recipient addresses and blockchain networks - Avoid links or messages claiming to be Fiber support - Keep account recovery methods current and accessible Onchain transactions may be irreversible once authorized. For a simpler explanation of ownership and user control, see [Non-Custodial](/non-custodial). For more information about wallet creation, signing, and recovery, see [Wallet Infrastructure](/wallet-infrastructure). --- Fiber is a financial technology company, not a bank. Banking services are provided by SSB, Member FDIC. Funds deposited at SSB are eligible for FDIC insurance up to $250,000 per depositor, per insured bank, subject to applicable limitations and FDIC rules.