It is the account layer of a financial product — identity, balance, permissions and history in one object, with other people’s software increasingly acting inside it. Almost every hard decision that follows is a product decision with a regulatory consequence, and only one of them is cryptographic.
Ten years ago a wallet held a key and showed a balance. The products being funded and shipped in 2026 are something else, and the gap between the two definitions is where most planning goes wrong — teams budget for a keychain and are asked to deliver an account.
For a growing share of products the wallet is the user record: identity, balance, history and permissions in one object. Storage is the least interesting thing it does.
Whoever owns the wallet owns the surface where the next product is launched. This is why exchanges, banks, messengers and card issuers all built one, and why several of them bought their way in rather than waiting.
Bank transfer becomes a stable balance, a balance becomes a card authorisation, a card authorisation becomes a settlement. The wallet is the junction, and each conversion has its own provider, its own licence and its own failure mode.
Limits, allow-lists, approvals, delegated permissions, expiry. In a consumer product these hide behind a button; in a business product they are the product.
Scoped, time-boxed, revocable permissions let an application — or an autonomous agent — act within limits its owner set. The specifications for this are still drafts, which is precisely why the design decisions matter now.
Because a wallet is now an account, the interesting questions stopped being cryptographic. They are product questions with regulatory consequences: what can a user do here, who else can act on their behalf, whose money is it while it sits, and what happens when someone loses their phone. The next section makes those choices explicit — switch on capabilities and watch the product change category underneath you.
In the largest losses on record the signatures were genuine, the threshold was met, and the allow-list was respected. What was compromised was the screen the signers were reading. Multisig has never failed in the way people budget for; interfaces fail constantly, and almost nobody funds that.
Of the embedded wallet vendors we examined, only a handful are cryptographically unable to sign without the user. The rest are contractually unwilling. Regulators wrote their test around the first property, and were explicit that a contractual obligation does not change the answer.
The curve securing most of this industry cannot be signed inside an Apple Secure Enclave, a TPM, Azure Key Vault or AWS CloudHSM. A multichain wallet needs five signing modes; the major cloud key services cover two, and one of the five is offered by nobody.
On a realistic first year the wallet licence is well under a fifth of the bill. Identity verification of the same cohort costs more. Sponsored gas — the line everyone worries about — totals a rounding error across the entire industry to date.
Not “is it non-custodial”. Ask: if your company stopped existing tomorrow, what exactly does my user do to move their funds — and can you show me the artefact that makes it possible? Four answers exist in this market. Everything else is a promise about behaviour.
Start with Key topology, then run the Custody line classifier. Those two sections decide your licence, your cost base and your recovery story before a single line of code exists.
Go to Anatomy of one signature and break the steps. If your product cannot survive the failures listed there, the gap is in the display layer, not in the key management.
Vendor landscape and Cost and build-vs-buy. The exit test matters more than the feature list: the questions there are the ones vendors answer slowly.
Multichain reality. Cost scales with curve groups, not with logos on a slide. Ten rollups are one integration; three unusual chains are three backends.
Standards board. Check the status badge before citing anything. Several of the most-quoted “standards” in this field are abandoned, still draft, or were never standards at all.
What we have built, at the end. It is deliberately last: the argument on this page should stand whether or not you ever hire anyone.
Every claim here traces to a primary source: a specification with a status field, a vendor’s own pricing or documentation page, a regulator’s published text, a forensic report, or a filing. Where a number is our arithmetic on published rates, the page says so. Where the industry publishes nothing — onboarding conversion, support ticket volume, transaction-monitoring pricing — the page says that too, because the absence is itself informative.
Every figure on this page is taken from a primary source — a specification, a vendor pricing page, a regulator’s text, a forensic report or a filing — and dated. Where the industry publishes nothing, the page says so instead of estimating. Standards statuses move; check the badge date before quoting one. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com
Switch on what your product needs. The panel tracks what it has become, what your users can now do, roughly how much engineering that is, how long it takes in calendar months, and where a licence appears. Core capabilities are locked because nothing works without them.
Effort is a property of the work; price is a property of a negotiation. Published day rates in this market differ by more than the scope usually does, so a number on a public page would tell you about our rate card rather than about your product. What is portable between vendors is the shape: which capabilities carry real engineering weight, which ones drag a licence behind them, and which ones look small on a roadmap and are not.
Every figure on this page is taken from a primary source — a specification, a vendor pricing page, a regulator’s text, a forensic report or a filing — and dated. Where the industry publishes nothing, the page says so instead of estimating. Standards statuses move; check the badge date before quoting one. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com
Two views of the same product. The board shows value crossing counterparties on every ordinary action; the walkthrough shows what the person on the other end actually sees.
Reference scenarios run concurrently, because in production they do. Click a chip to switch one off and watch what stops moving.
Every ordinary action on this board leaves your systems at least twice and comes back. A top-up touches four parties before a balance appears on a screen, and the shortest path here — sending money to a person — still runs through three of your own components plus the network. Each dashed box is a counterparty with its own authentication, schema, rate limits and incident channel; the lines between them are the reconciliation nobody demos.
The same product from the outside: four audiences, step by step. It plays on its own — pause it, step through it, or click any step.
The majority of any consumer wallet’s base, and the hardest to keep.
Small in number, loud in feedback, and the reason your support queue exists.
Where the product stops being a wallet and becomes a platform.
The newest pattern, and the one with the least standardisation behind it.
The same account has to serve a person who has never held a token, a person who reads calldata, a company with an approval quorum, and a piece of software acting under delegated authority. Products usually fail at the second audience they add, not the first, because the account model was designed for one of them and the rest are retrofitted into it.
Every figure on this page is taken from a primary source — a specification, a vendor pricing page, a regulator’s text, a forensic report or a filing — and dated. Where the industry publishes nothing, the page says so instead of estimating. Standards statuses move; check the badge date before quoting one. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com
Five layers, and a clear line between what you build and what you rent. Every block opens.
Click any block for what it does, what it is built from, what it assumes and how it fails.
Vendors cover chain access, indexing, money rails and identity — four boxes, and the cheapest four. Application logic, the transaction service and reconciliation are yours in every architecture, and together they are most of the build. The transaction service in particular has no vendor, no standard and no glory: nonce management, fee estimation, retries, idempotency and reorg handling. It is the layer that decides whether your wallet loses money quietly under load.
Every figure on this page is taken from a primary source — a specification, a vendor pricing page, a regulator’s text, a forensic report or a filing — and dated. Where the industry publishes nothing, the page says so instead of estimating. Standards statuses move; check the badge date before quoting one. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com
Pick a topology on the left. The panel answers the four questions that actually matter: who can sign without the user, what happens when the vendor disappears, what happens when the device is lost, and which side of the regulatory line it puts you on.
Shamir secret sharing reassembles the key in order to sign with it. Threshold signing never reassembles it at all. Several products describe the first as if it were the second. The test is simple and worth putting in writing to a vendor: at the moment of signature, does the complete private key exist anywhere, even briefly, even inside an enclave? If the answer is yes, you have secret sharing with good operational hygiene — which may be perfectly acceptable, but it is not what the marketing says.
Every figure on this page is taken from a primary source — a specification, a vendor pricing page, a regulator’s text, a forensic report or a filing — and dated. Where the industry publishes nothing, the page says so instead of estimating. Standards statuses move; check the badge date before quoting one. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com
Regulators do not ask what your architecture diagram says. They ask whether you can move the asset. Answer honestly — the point is to find the answer before a supervisor does.
This is an orientation tool built from published regulatory text, not legal advice, and it does not know your facts. Its job is to tell you which conversation to have and which article to bring to it.
Four regimes, one test. The wording differs; the question does not.
| What | Where | What it says |
|---|---|---|
| MiCA custody definition | Art. 3(1)(17) | Safekeeping or controlling crypto-assets or the means of access. Disjunctive by design. |
| Custodian duties and liability | Art. 75 | Segregation, and liability toward the client for loss — capped at market value at the time of loss, with the burden of proof on the custodian. |
| Who may be a CASP | Art. 59 | Authorised legal persons only. A third-country entity cannot serve EU clients from outside the Union. |
| Credit institutions | Art. 60 | A bank does not need a separate CASP licence — it notifies, 40 working days ahead, with six documents. Art. 75 still applies. |
| Transitional period | Art. 143 | Ended 1 July 2026, EU-wide, whether or not a member state finished implementing. |
| Travel rule | Reg. 2023/1113 | No lower threshold for crypto transfers. The €1,000 figure applies to verifying control of a self-hosted address, not to the transfer itself. |
| Proof of control | EBA/GL/2024/11 §83 | Five accepted methods, including a signed message and the satoshi test. §86 is the commercially useful one: after successful verification, the same address need not be re-verified on every subsequent transfer. |
| What | Where | What it says |
|---|---|---|
| Balance-sheet treatment | SAB 121 → SAB 122 | The gross-up requirement that made custody punitive for banks was rescinded on 23 January 2025. This, more than any crypto policy, is why bank custody restarted. |
| National banks | OCC IL 1183, IL 1184 | Supervisory non-objection removed; execution on customer instruction and use of sub-custodians permitted. |
| Federal Reserve | Programme withdrawal | Advance-notification expectation withdrawn April 2025; the novel activities supervision programme closed August 2025. |
| Money transmission | FinCEN FIN-2019-G001 | “Total independent control” is the test, even where the provider is contractually obliged to act only on instruction. |
| New York | NYDFS Part 200.9 | Custody guidance updated 30 September 2025, adding sub-custody with prior approval. Cite the 2025 version, not the 2023 one. |
| Adviser custody | Safeguarding Rule | The proposed rule was withdrawn in June 2025. There is currently no crypto-specific safeguarding rulemaking in force. |
| Stablecoin issuers | GENIUS Act | Federal framework for payment stablecoin issuance and reserve custody. |
| What | Where | What it says |
|---|---|---|
| Ledger-based securities | DLT Act | A registered uncertificated security can be transferred on a ledger with legal effect — the reason token issuance is domiciled here. |
| Bankruptcy remoteness | Art. 242a SchKG | Segregated crypto-assets can be separated from a bankrupt custodian’s estate. This is the substantive Swiss advantage, and it is a bankruptcy provision, not a marketing one. |
| Deposit-taking threshold | BankG Art. 1a/1b with BankV | Whether holding client crypto is deposit-taking depends on the accounting architecture. FINMA published a three-part matrix mapping architecture to licence tier in January 2026. |
| AML | AMLA / GwG | Custody makes you a financial intermediary: SRO membership or a licence. |
| Token classification | FINMA ICO guidance | Payment, utility or asset token — and an asset token is a security. Pre-financing a future deliverable points to the third box. |
| What | Where | What it says |
|---|---|---|
| Singapore | PSA, First Schedule | The trigger is written as “where the service provider has control” — the same test again, in different words. |
| Hong Kong | SFC VATP regime | Custody requirements are specified for licensed platforms, including cold-storage ratios. |
| United Arab Emirates | VARA; ADGM FSRA | Two separate regimes in one country. Licence numbers are published and worth checking rather than accepting. |
| Japan | FSA, post-incident regime | Segregation obligations tightened after two of the largest exchange losses in the industry’s history. Some custodians hold a mirror reserve in the same asset instead of insurance. |
| United Kingdom | FCA cryptoasset regime | The statutory instrument was made in February 2026 and the policy statements finalised in June 2026, but the regime commences in October 2027. The nearest deadline is the application window, not the regime. |
Every figure on this page is taken from a primary source — a specification, a vendor pricing page, a regulator’s text, a forensic report or a filing — and dated. Where the industry publishes nothing, the page says so instead of estimating. Standards statuses move; check the badge date before quoting one. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com
This is the whole product, end to end. The failures that cost the most money in this industry all land in the same two steps, and neither of them is the cryptography.
Seven steps. Toggle a real-world failure and watch which steps it lands on.
Steps one, two, six and seven are engineering. Steps four and five are hardware. Step three is the entire security model of a consumer wallet, and it is the step every vendor demo skips, because it is the one that cannot be made to look impressive. If a vendor cannot show you how their signer renders a payload independently of the interface that produced it, they have not solved the problem that has caused the largest losses in this industry.
Every figure on this page is taken from a primary source — a specification, a vendor pricing page, a regulator’s text, a forensic report or a filing — and dated. Where the industry publishes nothing, the page says so instead of estimating. Standards statuses move; check the badge date before quoting one. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com
Two markets sit under one word. Below: who can sign without your user, what happens when the vendor disappears, and the ten questions worth sending in writing before anyone talks about price.
| Vendor | Key model | Vendor outage | Exit artefact | Watch-out |
|---|---|---|---|---|
| Privy Stripe | Two shares, both inside the provider perimeter | ✗depends | Key export available | Both shares sit within one operator’s boundary. Contractual SLA is 99% — roughly seven hours a month. |
| Dynamic Fireblocks | TSS-MPC, user share on device | ✓survives | Open-source offline recovery tool | One of the few with a documented path that survives the vendor. Billing counts a wallet from the moment it is pre-generated, so pre-generating for your whole base bills your whole base. |
| Turnkey Independent | Key reconstructed inside a secure enclave | ✗depends | Export available | This is not MPC, despite being widely described as such: the whole key exists inside the enclave at signing time. |
| Para Independent | Two-of-two, share on device | ✓survives | Backup Kit issued to you | No native gas sponsorship, so a paymaster is a second vendor and a second line item. |
| Portal Monad Foundation | Parallel two-of-two, four shards | ✓survives | Backup shards on your infrastructure | Vendor and organisation shards sit in different pairs and cannot collude. Billing counts backups and recoveries as events. |
| MetaMask Embedded Consensys | Shamir on self-serve tiers; TSS only on enterprise | ✗depends | Reconstructed client-side | On every self-serve tier this is secret sharing, not threshold signing. The key is reassembled on the client. |
| Magic Kraken/Payward (WaaS assets) | Delegated key management | ✗depends | Not documented | No offline recovery path. If the service ends, the wallets do not come back. Liability in the terms is capped at a nominal amount. |
| Circle Circle | MPC, optionally self-hosted nodes | ✗depends | Depends on deployment | Self-hosted nodes are the only route to a jurisdictional guarantee. Pricing is not published. |
| Coinbase CDP Coinbase | Enclave-backed, policy-gated | ✗depends | Not documented | Billing counts policy evaluations, not only signatures. Which Coinbase entity contracts is worth establishing before assuming any licence applies to you. |
| Openfort Independent | Configurable; self-hosted signer available | ✓survives | Self-hosted OpenSigner is open source | Self-hosting is the only way anyone in this table offers data residency you can point at. |
| thirdweb Independent | Delegated, enclave-backed | ✗depends | Export available | Cheapest at scale on published rates — by a wide margin, which is itself a reason to read the terms carefully. |
| Tether WDK Tether | You run it — it is a toolkit, not a service | ✓survives | Yours by construction | Apache-2.0 and genuinely open. But the indexer is a hosted Tether service: not self-hostable, no published SLA, coverage concentrated on its own assets, new chains requested through a form. No RPC, auth, recovery or compliance layer. Build the read layer yourself from day one. |
| Provider | What it actually is | Technology | Watch-out |
|---|---|---|---|
| Fireblocks | Technology provider | MPC-CMP with enclave isolation | Published entry pricing exists; the meaningful number is basis points on outbound volume, which makes it unit economics rather than an IT line. |
| BitGo | Qualified custodian (US trust charters) | Classic 2-of-3 multisig, not MPC | The most common misconception in the category. Insurance is a shared crime policy, not a per-client limit. |
| Anchorage Digital | US national trust bank | HSM at FIPS 140-2 Level 3 with custom logic in hardware | Deliberately rejected MPC. The only federally chartered crypto bank in the US. |
| Taurus | Technology provider (Swiss) | Open-sourced MPC-CMP | Publicly argues an HSM is required with or without MPC — a rare case of a vendor arguing against the simpler version of its own product. |
| Zodia Custody | FCA and CBI registered | HSM-based | Being absorbed by its bank shareholder, with the platform split into a separate entity. Any statement about ownership needs a date attached. |
| Sygnum | Swiss bank (FINMA) | Bank-grade key ceremony | Holds a banking licence but reports under ISAE 3402 rather than SOC 2 — a procurement checklist that demands SOC 2 Type II mechanically excludes Swiss banks. |
| GK8 (Galaxy) | Technology provider | Air-gapped signing, no inbound connection | The only vendor found publishing a per-client, per-vault insurance limit rather than an aggregate one. |
| Ledger Enterprise | Technology provider | Secure-element based | Consumer brand and enterprise product share a name and very little else. |
| Cobo | Technology provider | MPC with a policy engine | Documents its own degradation by chain: on some networks policy granularity drops to programme level or to initiators only. |
| Utila | Technology provider | MPC | Gas station alerts rather than refuels, and sweeps can sit in an approval queue — automatic sweeping and a manual quorum are not compatible. |
| DFNS | Technology provider | MPC, on-premise option | One of the few offering an on-premise deployment, which is the practical answer to data residency. |
| Safe | Not a custodian — self-custodial infrastructure | On-chain multisig with modules | The transaction service moved from MIT to a source-available licence in February 2026 and the hosted API became paid. Any evaluation older than that is stale on this point. |
Ten questions. Send them in writing, before the commercial conversation, and note which ones come back slowly.
On every tier, not only enterprise. “Export” that requires your service to be online is not an exit.
Not the documentation page — the artefact. Ask for the tool, run it in a sandbox, and confirm it works with your service disabled.
Including inside an enclave, including for microseconds. This single question separates threshold signing from secret sharing.
If your company or a subsidiary can complete a quorum, you are inside a regulated definition regardless of the label.
Which region, which provider, under which contract. Then ask whether you can pin it, and get the answer in the agreement rather than in an email.
Monthly actives, signatures, policy evaluations, balance reads, backups, or wallets created in someone else’s product. These are not comparable, and the spread across this market is a factor of thirty-two on identical usage.
Within a single vendor, list and negotiated pricing differ by up to thirty times. A conversation is cheaper than a migration.
One major vendor commits to 99% — roughly seven hours of downtime a month, by agreement. For a wallet, that number belongs in the incident plan.
Group brand and contracting entity are frequently different. Never assume a parent’s authorisation extends to the product you are buying.
There is no standard for exporting threshold shares. In practice migration means every user takes an action — so ask what fraction of users the vendor has seen complete one.
Ten vendors in this category changed hands in roughly two years, and several now share a corporate parent with a vendor elsewhere in the same stack. Concentration risk is no longer theoretical: it is possible to pick three “independent” suppliers and end up with one counterparty. Any statement about who owns your vendor needs a date attached to it.
Limits are aggregate across all clients, not per client. One provider publishes pro-rata sharing between affected customers in the event of a claim. Another commits only to endeavour to make customers whole. Exactly one publishes a per-client, per-vault limit.
Insider collusion involving officers is frequently excluded. So is protocol failure. And at least one custodian’s agreement excludes losses arising from the client’s own instructions or authorisations — which means a mistake in your policy configuration is uninsured by construction.
The three largest custodial losses on record were all made good from company funds, not from a policy. The largest facility publicly reported in this market is smaller than a single one of those losses.
The US audit regulator has stated plainly that these engagements are not audits and do not provide meaningful assurance, and that the procedures typically do not address liabilities or whether the assets were borrowed. Two major firms exited the practice in the same month in 2022.
Every figure on this page is taken from a primary source — a specification, a vendor pricing page, a regulator’s text, a forensic report or a filing — and dated. Where the industry publishes nothing, the page says so instead of estimating. Standards statuses move; check the badge date before quoting one. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com
Chains are not the unit of work. Curve groups are. Pick your target networks and the panel shows how many distinct signing backends you have just committed to, and which of them no managed key service can host.
Select the chains you intend to support.
Ten EVM rollups are one integration. Bitcoin, Solana and Polkadot are three, and each brings its own signing backend, its own address rules, its own fee model and its own indexer. A roadmap that says “twenty chains” and a roadmap that says “four signing backends” can describe the same product — only one of them is an estimate.
This is the table that decides whether your keys can live in managed infrastructure at all.
| Key service | ECDSA secp256k1 | EdDSA ed25519 | Schnorr BIP-340 | sr25519 | ECDSA secp256r1 |
|---|---|---|---|---|---|
| AWS KMS | ✓ | ✓ | ✗ | ✗ | ✓ |
| Google Cloud KMS | ✓ | ✓ | ✗ | ✗ | ✓ |
| Azure Key Vault / Managed HSM | ✓ | ✗ | ✗ | ✗ | ✓ |
| AWS CloudHSM | ✓ | ✗ | ✗ | ✗ | ✓ |
| Apple Secure Enclave | ✗ | ✗ | ✗ | ✗ | ✓ |
| TPM 2.0 | ✗ | ✗ | ✗ | ✗ | ✓ |
| Common IoT secure elements | ✗ | ✗ | ✗ | ✗ | ✓ |
Every figure on this page is taken from a primary source — a specification, a vendor pricing page, a regulator’s text, a forensic report or a filing — and dated. Where the industry publishes nothing, the page says so instead of estimating. Standards statuses move; check the badge date before quoting one. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com
One decision, three ways to answer it. Start with what each posture actually leaves on your side, answer eight questions, then look at the two annual figures side by side and find where they cross.
Before any number: these are the three things being compared, and what each one actually leaves on your side of the line.
Application logic, the transaction service, history and reconciliation appear in all three. No vendor removes them, and together they are most of the build. The build-versus-buy argument is therefore about one layer — who holds the key material — and not about the size of the project, which is roughly the same either way.
Eight questions. Same format as the custody classifier, and it takes about a minute.
Two annual figures at the same user count: what the vendors charge, against what a standing team costs. Both sides are built from published numbers — vendor list prices and published engineering salary bands — so the comparison is portable and neither side is our rate card.
Vendor side: arithmetic on published list rates at a stated usage profile. Build side: published engineering salary bands for the roles this layer requires, plus a recurring audit allowance, and it excludes the application work that both sides pay for anyway. Both are rounded hard and shown as an order of magnitude. This is a shape, not a quote.
A threshold-signing library patch is a migration of every key in the system, not a deployment. Plan it as a programme with user action, because that is what it is.
Both major app stores require an organisation account: a wallet cannot be published by an individual. One store additionally lists jurisdictions with licensing prerequisites, and explicitly places non-custodial wallets outside that scope — turning an architecture choice into a distribution choice.
Settlement does not observe business hours. The staffing line for out-of-hours incident response is routinely missing from wallet budgets and is rarely small.
When a sponsorship service degrades, your users see failed transactions and blame you. Independent monitoring of your dependencies is a product requirement, not an infrastructure nicety.
Buying does not remove this if you deploy contracts. The most widely used smart-account entry point has needed several audits and produced multiple high-severity findings; the most widely used multisig has been audited on the order of eighteen times, each minor version again.
Not one major transaction-monitoring provider publishes pricing. Budget it as a negotiated line and open the conversation early, because you cannot estimate around it.
Every figure on this page is taken from a primary source — a specification, a vendor pricing page, a regulator’s text, a forensic report or a filing — and dated. Where the industry publishes nothing, the page says so instead of estimating. Standards statuses move; check the badge date before quoting one. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com
Thirty specifications a wallet touches, with the status they carried when this page was built. Filter by layer. The badges are the point.
| Standard | What it is | Status | Why it matters |
|---|
One. Deployment and standardisation do not correlate: two of the most-called wallet methods in Ethereum are formally abandoned, while the permissions specification nobody argues about is ratified. Two. Some widely cited “standards” have no specification at all — one of them appears in security-token proposals constantly and exists only as a closed, stale issue. Three. Portability is structurally unsolved: there is no standard for exporting threshold shares, and the credential-exchange format that finally shipped defines seventeen credential types, none of which is a wallet key.
Every figure on this page is taken from a primary source — a specification, a vendor pricing page, a regulator’s text, a forensic report or a filing — and dated. Where the industry publishes nothing, the page says so instead of estimating. Standards statuses move; check the badge date before quoting one. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com
Deliberately last. The argument above should hold whether or not you ever work with us — this is the evidence that we have run into these failures ourselves.
Eight engagements. Client names are withheld where our agreements require it — the badge states the level of disclosure rather than leaving you to guess. Click any card for what was delivered, the technology, and what came out of it.
We start from the signing model, because everything downstream — licence, recovery, cost, incident response — is decided by it. We write down who can sign without the user before anyone writes code, and we test the vendor’s failure mode instead of reading its marketing. Where a product already exists, the first engagement is usually an honest read of the display step in Anatomy of one signature, because that is where the money is lost.
Every figure on this page is taken from a primary source — a specification, a vendor pricing page, a regulator’s text, a forensic report or a filing — and dated. Where the industry publishes nothing, the page says so instead of estimating. Standards statuses move; check the badge date before quoting one. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com