Privacy-First Authentication
How TTC generates, stores and unlocks the wallet keys behind your account.
What is PrivaC?
PrivaC is our client-side encryption system. Your wallet keys are generated in your browser and encrypted there before they are stored with your account on our servers, so the server only ever holds ciphertext. Decryption happens in your browser, on demand, for the signature that needs it.
The encryption key is derived from how you sign in — a wallet signature for Web3 users, your passkey phrase for email users, or your device passkey for biometric users. It never reaches our servers and is never saved in plaintext: it is held in memory while the vault is unlocked and dropped when the vault locks or the page reloads. If you turn on biometric unlock, your device keeps a copy encrypted under your device passkey.
How PrivaC Works
1. Register & Derive Your Key
Sign in with a Web3 wallet, an email address, or a device passkey. Your browser derives the app key from that sign-in: a signature from your wallet, PBKDF2 over your passkey phrase salted with your email, or the WebAuthn PRF output of your device passkey.
2. Encrypt & Store
Solana and EVM wallets are generated in your browser and each private key is encrypted with your app key. Only the ciphertext is sent to our servers, where it is stored with your account.
3. Decrypt Only to Sign
When an order or transfer needs a signature, the key is decrypted in memory for that one signing call and discarded straight after.
Key Features of PrivaC
Ciphertext-Only Storage
Private keys are encrypted in your browser with AES-256-GCM before they are uploaded. Our servers store only that ciphertext with your account and never receive the key that decrypts it.
Three Ways to Sign In
Use a Web3 wallet, an email address with a passkey phrase, or a passkey on your device. Device-passkey accounts unlock with a biometric or PIN check; wallet and email accounts can turn that on as an optional unlock.
Decrypted Only to Sign
For signing, a plaintext private key exists only inside the single signing call that needs it, and is dropped as soon as that call returns. Revealing a key on your dashboard is a separate step that asks you to unlock again each time.
Auto-Locking Vault
The key that decrypts your wallets is held in memory and locks 60 seconds after you unlock it; some signing steps restart that timer.
Benefits for Users
Email Registration
Sign up with an email address and a passkey phrase. We generate Solana and EVM wallets in your browser and encrypt them with a key derived from that phrase. The phrase never leaves your device, so TTC cannot reset it for you.
Web3 Wallet Integration
Connect Phantom, Solflare, or another Solana wallet. Your wallet signs a fixed message to derive the encryption key, and your wallet's own private key never leaves the wallet.
Memory-Only App Key
The app key is held in memory while the vault is unlocked and is never saved in plaintext. Refreshing the page drops it, so the vault always starts locked and asks you to unlock again. If you turn on biometric unlock, an encrypted copy wrapped by your device passkey stays on that device so your biometric check can unlock it.
Cross-Platform Access
Access Orderly Network, Vest Exchange, and other integrated platforms with one set of encrypted credentials.
How PrivaC Makes Signups Easy
Traditional crypto platforms store your keys on their servers or require you to manage seed phrases. PrivaC encrypts your keys in your browser, so our servers only ever store ciphertext:
No Passwords for Web3: Web3 users derive their encryption key from a wallet signature, so there is nothing to remember. Email users choose a passkey phrase instead.
Biometrics Only Where You Chose Them: Device-passkey accounts unlock with your device's biometric or PIN check. Wallet and email accounts unlock with a wallet signature or the passkey phrase, unless you turn on biometric unlock in your settings.
A Short Exposure Window: Nothing can be decrypted while the vault is locked, and it locks 60 seconds after you unlock it (some signing steps restart that timer). No browser-based design makes keys immune to malicious code running on the page; this one keeps the window short.
Zero Plaintext on Server: Wallets are created client-side, encrypted, and sent to the server as encrypted blobs. On login, the server returns the blob and decryption happens entirely in your browser — the server never sees plaintext private keys.
Experience PrivaC Today
Trade across Orderly Network, Vest Exchange, and more with keys that are encrypted in your browser and decrypted only when you sign.