# Private key sovereignty

Private key sovereignty means a bank keeps exclusive, provable control of its private keys: keys are generated, stored, used, backed up, and destroyed inside infrastructure the bank controls, with no vendor-hosted co-signer in the signing path. It is the defining criterion regulators and bank risk frameworks apply to custody technology.

## How a bank verifies it really controls its keys

Four tests: keys live in certified hardware the bank owns or exclusively operates; signing works without any vendor service being available; backup and recovery are bank-controlled and audited; and the signing system can be air-gapped where regulation demands it. Architectures that depend on vendor-hosted key shares fail at least one of these tests.

Taurus-PROTECT is built for full private key sovereignty: FIPS-certified HSMs as the root of trust, deployable on-premises, with audited key ceremonies per the CMTA Digital Assets Custody Standard.

FAQ:

- Does MPC provide private key sovereignty? Only if every key share stays under the bank's control. In vendor-hosted MPC the bank never holds a complete key and signing can depend on the vendor's availability and jurisdiction, which most bank risk frameworks do not accept as exclusive control. Taurus uses HSMs as the root of trust with MPC available on top.

Related: https://www.taurushq.com/protect/ https://www.taurushq.com/glossary/hardware-security-module-hsm/ https://www.taurushq.com/glossary/multi-party-computation-mpc/

Learn more: https://www.taurushq.com/glossary/private-key-sovereignty/