Skip to main content

​
What “zero-trust” means

Your keys are split into two parts using cryptography:
  1. Your share - encrypted with your passcode, stored in the Ika network
  2. Network share - held by Ika validators
To sign anything, both shares must participate. But they never combine into a complete key. The signature is produced through a secure multi-party computation where neither party learns the other’s share.

​
What Umi never has

  • Your complete private key (it never exists in complete form)
  • Your passcode (only you know it)
  • The ability to sign without your approval
  • Access to move your funds unilaterally

​
What Umi does have

  • Your encrypted key share (but can’t decrypt it without your passcode)
  • Your public addresses (these are public by design)
  • Your transaction history (for display in the app)

​
What the Ika network never has

  • Your complete private key
  • Your passcode
  • Your encrypted key share’s decryption key
  • The ability to sign without the user’s participation

​
The security model

For someone to steal your funds, they would need:
  1. Your passcode (to decrypt your key share)
  2. Access to the Ika network’s share (held by distributed validators)
  3. To compromise both at the same time
This is dramatically more secure than:
  • Centralized exchanges - one company holds everything
  • Traditional wallets - one seed phrase controls everything
  • Hardware wallets - one device holds everything

​
Protecting your account

Use a strong passcode Your passcode encrypts your key share. Make it at least 12 characters with a mix of letters, numbers, and symbols. Protect your login Your Google/Apple/Facebook account is how you access Umi. Use strong passwords and 2FA on those accounts. Verify transactions Always check transaction details before confirming. Make sure the destination and amount are correct. Be careful with DApp connections Only connect to DApps you trust. Review what permissions they’re requesting.

​
If something goes wrong

Lost your passcode? Your passcode encrypts your key share. Without it, you can’t sign transactions. Umi cannot recover your passcode. This is a security feature - if we could recover it, so could an attacker. Lost access to your login? Recover your Google/Apple/Facebook account through their normal recovery process. Your Umi account is linked to that identity. Suspicious activity? Contact support immediately. We can help investigate, though we cannot access or move your funds.

​
Audits and transparency

Umi uses Ika’s audited cryptographic protocols. The core signing technology has been reviewed by security researchers. Smart contracts deployed on Sui are verifiable on-chain. We’re committed to transparency about how the system works. If you have security questions, reach out.