# Independent self-custody security review

> Already hold your own crypto? A structured, independent check of the setup you have, without
> anyone ever seeing your recovery phrase, and a written report of what to fix, worst first.

**In short.** A security review looks at how you hold your crypto today: your backups, your
devices, your exposure to phishing and scams, and whether the right person could recover
everything if something happened to you. Nothing is changed during the review, and you never
reveal anything secret. You get a written, prioritised list of what to fix, and an explicit list
of what is already fine. From £295, fixed price, agreed in writing before you commit.

- Who it is for
- The four things a review looks at
- How a review works without seeing your seed phrase
- What happens, step by step
- What you get
- Right-sized, not paranoid
- What it costs
- What KeyCompass never does
- Common questions

## Who it is for

- You set up a hardware wallet (the physical device that keeps your keys offline) yourself and
  have never had it checked.
- You set it up years ago, and your holdings, devices or household have changed since.
- You use a passphrase, several devices or multisig, and want a second pair of eyes on it.
- You have had a scare: a convincing phishing email, a lost device, a backup you can't find.
- You are about to move a larger amount into self-custody and want the setup checked first.
- You run a small business that holds crypto and want to know where the weak points are.

If you are starting from scratch, an [onboarding session](https://keycompass.co.uk/onboarding)
is the better fit.

## The four things a review looks at

Most self-custody losses come through one of four routes, and a review checks each of them.

- **Phishing and scams.** How exposed you are to fake support, fake apps and lookalike sites,
  which email and phone accounts an attacker could use against you, and whether you would
  recognise the scams aimed at people like you.
- **Your devices.** Whether your device is genuine and up to date, how it is protected and
  where it is kept, and the state of the computer and phone you use with it.
- **Backup loss.** Where your recovery phrase is stored, what it is written on, how many copies
  exist, whether it has been tested, and how any passphrase is backed up.
- **Succession.** Whether the right person could find your backup and use it if something
  happened to you, and whether anyone could who shouldn't.

## How a review works without seeing your seed phrase

You never show your recovery phrase, a private key or an unlocked wallet, and you are never asked
to. A review works through questions and through checks you run yourself: you describe your
setup, I ask what to look at, and you carry out checks such as the device's built-in backup test
on your own device. Screen sharing runs on my side only.

Nothing is changed during the review. I look, I ask, and I write it up. You decide what to change,
and when.

## What happens, step by step

1. **A free thirty-minute intake call** to understand roughly what you have and agree the scope.
2. **A written scope and fixed price,** before anything is booked.
3. **The review itself,** on a video call, working through the four areas above.
4. **Your written report,** usually within a few days.
5. **A follow-up check** once you have made the changes, to confirm they are done properly.

## What you get

- A prioritised list of what to fix, worst first
- Plain-English reasoning for every item, not a score out of ten
- An explicit list of what is already fine, so you can stop worrying about it
- A follow-up check once you have made the changes

## Right-sized, not paranoid

A good review doesn't add complexity for its own sake. Sometimes the right recommendation is to
simplify: fewer copies, fewer devices, a plan your family could actually follow. If your setup is
already sound for what you hold and how you live, the report will say so.

## What it costs

**From £295.** That covers one wallet with one backup, including the written report. Several
devices, multisig or a business setup sit higher. You get the exact figure in writing after the
intake call, before you commit to anything.

Fees are fixed, never a percentage of what you hold, and nobody at KeyCompass needs to know how
much you hold to quote you. KeyCompass is not registered for VAT, so the price shown is the price
you pay. [See all prices](https://keycompass.co.uk/pricing)

## What KeyCompass never does

- Hold your keys, your recovery phrase or your crypto, even for a moment
- Ask to see your recovery phrase, a photo of it or any part of it
- Take remote control of your computer
- Tell you what to buy, sell or hold
- Take commission from wallet makers or exchanges

## Common questions

**Do I have to tell you how much I hold?** No. The review is about how your crypto is held, not how
much. Some recommendations depend on scale, and you can describe that as loosely as you like.

**Can you review a multisig setup?** Yes. Multisig reviews also check the wallet configuration
backup and whether a quorum of keys could still be gathered if one were lost.

**Will you fix things during the review?** No. Nothing is changed during a review. If you would
like help making the changes afterwards, that can be arranged separately.

**How often should a setup be reviewed?** After any big change, such as a new device, a house move,
a larger deposit or a change in your family, and otherwise every year or two.

**Do you review business setups?** Yes. Business reviews also look at who has access, how
approvals work, and what happens if a key person leaves.

## Before you book

These guides cover some of the same ground:

- [How to test your recovery phrase backup safely](https://keycompass.co.uk/guides/test-recovery-phrase-backup)
- [Seed phrase storage: where should I keep mine?](https://keycompass.co.uk/guides/seed-phrase-storage)

[Book the free intake call](https://cal.com/simongeils/30min)