Independent self-custody security review

• You set up a hardware wallet (the physical device that keeps your keys offline) yourself and have never had it checked.
• You set it up years ago, and your holdings, devices or household have changed since.
• You use a passphrase, several devices or multisig, and want a second pair of eyes on it.
• You have had a scare: a convincing phishing email, a lost device, a backup you can't find.
• You are about to move a larger amount into self-custody and want the setup checked first.
• You run a small business that holds crypto and want to know where the weak points are.

If you are starting from scratch, an onboarding session is the better fit.

Most self-custody losses come through one of four routes, and a review checks each of them.

• Phishing and scams. How exposed you are to fake support, fake apps and lookalike sites, which email and phone accounts an attacker could use against you, and whether you would recognise the scams aimed at people like you.
• Your devices. Whether your device is genuine and up to date, how it is protected and where it is kept, and the state of the computer and phone you use with it.
• Backup loss. Where your recovery phrase is stored, what it is written on, how many copies exist, whether it has been tested, and how any passphrase is backed up.
• Succession. Whether the right person could find your backup and use it if something happened to you, and whether anyone could who shouldn't.

You never show your recovery phrase, a private key or an unlocked wallet, and you are never asked to. A review works through questions and through checks you run yourself: you describe your setup, I ask what to look at, and you carry out checks such as the device's built-in backup test on your own device. Screen sharing runs on my side only.

Nothing is changed during the review. I look, I ask, and I write it up. You decide what to change, and when.

1. A free thirty-minute intake call to understand roughly what you have and agree the scope.
2. A written scope and fixed price, before anything is booked.
3. The review itself, on a video call, working through the four areas above.
4. Your written report, usually within a few days.
5. A follow-up check once you have made the changes, to confirm they are done properly.

• A prioritised list of what to fix, worst first
• Plain-English reasoning for every item, not a score out of ten
• An explicit list of what is already fine, so you can stop worrying about it
• A follow-up check once you have made the changes

A good review doesn't add complexity for its own sake. Sometimes the right recommendation is to simplify: fewer copies, fewer devices, a plan your family could actually follow. If your setup is already sound for what you hold and how you live, the report will say so.

From £295. That covers one wallet with one backup, including the written report. Several devices, multisig or a business setup sit higher. You get the exact figure in writing after the intake call, before you commit to anything.

Fees are fixed, never a percentage of what you hold, and nobody at KeyCompass needs to know how much you hold to quote you. KeyCompass is not registered for VAT, so the price shown is the price you pay. See all prices

• Hold your keys, your recovery phrase or your crypto, even for a moment
• Ask to see your recovery phrase, a photo of it or any part of it
• Take remote control of your computer
• Tell you what to buy, sell or hold
• Take commission from wallet makers or exchanges

Do I have to tell you how much I hold? No. The review is about how your crypto is held, not how much. Some recommendations depend on scale, and you can describe that as loosely as you like.

Can you review a multisig setup? Yes. Multisig reviews also check the wallet configuration backup and whether a quorum of keys could still be gathered if one were lost.

Will you fix things during the review? No. Nothing is changed during a review. If you would like help making the changes afterwards, that can be arranged separately.

How often should a setup be reviewed? After any big change, such as a new device, a house move, a larger deposit or a change in your family, and otherwise every year or two.

Do you review business setups? Yes. Business reviews also look at who has access, how approvals work, and what happens if a key person leaves.

These guides cover some of the same ground:

• How to test your recovery phrase backup safely
• Seed phrase storage: where should I keep mine?

Book the free intake call