Architecture

Understand how Cubewire Wallet-as-a-Service processes transactions, manages security, and integrates with your systems.

Cubewire Wallet-as-a-Service is designed with security and reliability at its core. Every transaction flows through multiple layers of protection—from authentication and policy enforcement to compliance screening and HSM-based signing—before reaching the blockchain.

This page covers:

• Transaction lifecycle — What happens when you submit a transaction
• Vaults — How keys and addresses are organized
• Security model — How we protect your keys and assets
• Compliance integration — Built-in regulatory checks
• Integration patterns — Common ways to connect your systems

---

Vaults

A vault is a secure container for blockchain keys and addresses. Each vault is isolated with its own cryptographic material stored in hardware security modules (HSM).

Vault Capabilities

• Multi-chain addresses — Each vault can hold assets across supported EVM networks
• Isolated keys — Private keys are unique per vault and never shared
• Configurable policies — Attach spending limits, allowlists, and approval rules
• Full audit trail — Every operation is logged for compliance and reporting

---

How It Works

Here's what happens when you send a transaction through Cubewire:

The entire flow—from request to blockchain confirmation—typically completes in seconds. For transactions requiring approval, you control the workflow through our approvals API.

---

Security Model

Cubewire employs multiple layers of security to protect your assets:

Key Protection

Your private keys are:

• Generated inside HSMs — Keys are created within certified hardware, not imported
• Never exported — Signing happens inside the HSM; raw keys are never exposed
• Geographically distributed — Infrastructure spans multiple regions for resilience
• Backed up securely — Encrypted backups ensure business continuity

---

API Authentication

All API requests use OAuth 2.0 client credentials flow:

---

Built-in Compliance

Cubewire integrates with leading compliance providers to automate regulatory requirements. Configure these checks at the organization level—they run automatically on every transaction.

Compliance Checks

---

Integration Patterns

Choose the pattern that fits your use case:

Server-to-Server

Best for backend services that need programmatic access to wallets.

Your server authenticates with Cubewire using API credentials and performs operations on behalf of your users. Transaction events flow back via webhooks.

Use cases: Automated payouts, treasury operations, trading bots

Approval Workflows

Best for high-value transactions requiring human approval.

Define approval thresholds in your policies. When a transaction triggers approval, designated approvers receive notifications and vote through your interface.

Use cases: Treasury management, large transfers, compliance-sensitive operations

Event-Driven

Best for systems that react to blockchain activity in real-time.

Subscribe to webhook events and process them asynchronously. We handle retries and provide HMAC signatures for verification.

Use cases: Real-time dashboards, notifications, accounting systems, audit logging

---

Webhook Events

Cubewire sends real-time webhook notifications for transaction lifecycle events—from submission through confirmation or failure. All payloads include HMAC signatures for verification.

See Webhooks for event types, payload formats, and security best practices.

---

Supported Networks

Cubewire supports EVM-compatible blockchains:

---

Audit & Activity Logs

Every action in Cubewire is recorded for compliance and operational visibility:

Logs are retained according to your organization's compliance requirements and are accessible via API for integration with your SIEM or reporting systems.

---

Next

• Core Concepts — Key domain concepts for building on Cubewire