Security Model | TZUR Wallet
Non-Custodial by Design
TZUR is fully non-custodial. Your private keys are never stored on our servers, and TZUR has no ability to access, freeze, or move your funds. There are no accounts, no cloud storage of wallet data, and no server-side record of your holdings. Your keys exist only on your device. If TZUR's servers disappeared tomorrow, your Bitcoin would remain fully accessible: you can recover your wallet from your recovery phrase in any BIP-39 compatible wallet. This is self-custody in its truest form: you hold the keys, you own the Bitcoin.
Open Bitcoin Standards
TZUR is built entirely on open, audited Bitcoin standards, so your wallet is portable and your recovery is verifiable in any compatible software. Your recovery phrase follows BIP-39 (12 words by default, with a 24-word option). Keys are derived hierarchically with BIP-32, so every address and key pair comes from a single master seed, and addresses use BIP-84 Native SegWit (bech32) on the standard path m/84'/0'/0'. Behaviour is fully deterministic: the same recovery phrase always produces the same addresses, on any device. TZUR also supports an optional BIP-39 passphrase. The iPhone app implements these standards natively in Swift; the Android app uses the Bitcoin Dev Kit (BDK) library, built on an audited Rust core.
Your Recovery Phrase Stays With You
Your recovery phrase is generated locally using your operating system's cryptographically secure random number generator: SecRandomCopyBytes on iOS and SecureRandom on Android. It is the sole recovery mechanism for your wallet. TZUR does not store it, transmit it, or have any access to it. It is never sent over the network, never written to server logs, and never included in analytics. It is shown once at wallet creation and can be re-viewed in the app for backup, behind authentication. If you lose both your recovery phrase and your device, no one, including TZUR, can recover your Bitcoin. We strongly recommend writing it down and storing it in a secure, offline location.
On-Device Key Storage
Your seed is encrypted at rest using the strongest protection each operating system provides, and is never stored in plaintext. On iPhone, it is held in the iOS Keychain with the this-device-only protection class: accessible only while the device is unlocked, non-exportable, and excluded from backups and device migration. On Android, the seed is sealed with AES-256-GCM using a non-exportable Android Keystore key, StrongBox-backed when the device supports it, with a Trusted Execution Environment fallback. TZUR never stores sensitive data in unprotected storage.
Authentication & Device Lock
Access to your keys is gated by your device authentication and an app PIN. Your PIN is never stored; only a PBKDF2-HMAC-SHA256 hash (600,000 iterations, with a random per-wallet salt) is kept, and it is compared in constant time. On iPhone, unlock uses Face ID or Touch ID through Apple's LocalAuthentication, and the biometric proof is invalidated if your enrollment changes. On Android, it uses BiometricPrompt at the strong-biometric class. Auto-lock and re-lock on sleep are supported.
Key Material Is Treated as Toxic Data
Private key material exists in memory only for the moment it is needed to sign a transaction. Key buffers are zeroed immediately after use, and keys are never cached in application state, never written to temporary files, never logged, and never persisted outside secure storage. On iPhone, the recovery phrase and passphrase screens block screen recording and warn on screenshots; on Android, the build itself fails if logging APIs appear in the key-management module, and seed and PIN screens use screenshot protection. One honest limitation, stated in our own code: a recovery phrase briefly held as a text string cannot be force-wiped because language runtimes make strings immutable, so we keep its lifetime as short as possible.
Transactions Are Signed Locally
All transaction construction and signing happen on your device. The wallet loads key material, signs, and zeroes it, with no network activity while keys are live; only the finished, already-signed transaction is broadcast. Watch-only wallets and locked passphrase wallets cannot sign at all, and a fresh authentication is required before every signature. On iPhone this runs in the app's own Swift signing engine; on Android it runs in BDK.
Servers Are Never Trusted
TZUR talks to public Electrum servers for blockchain data such as balances, history, and fee estimates, but treats them strictly as untrusted data providers. Connections are TLS-only with certificate pinning on iPhone; a server whose certificate does not match the pin is rejected with no fallback. On iPhone, incoming history is verified with Merkle proofs against a proof-of-work header chain; on Android, returned chain data is validated with SPV and Merkle proofs before it reaches your balance. Wallet lookups use script hashes rather than your addresses, and the only thing ever uploaded is a fully-signed transaction for broadcast. Your keys, recovery phrase, and PIN are never transmitted. Failover across multiple independent servers prevents any single operator from withholding data.
App Integrity Attestation
To protect the optional BlockSight explorer's API from abuse, TZUR uses platform attestation, Apple App Attest on iOS and Google Play Integrity on Android, to prove that requests come from a genuine, unmodified app. This is isolated from your wallet: attestation gates only public blockchain-explorer data, never key material or fund operations, and if it ever fails, only the explorer is affected while your wallet keeps working.
Privacy-Respecting Analytics
TZUR Wallet may collect anonymous usage analytics to improve the application. These analytics help us understand how features are used and where the user experience can be improved. Analytics collection is entirely optional and can be disabled at any time in the app's Settings. When enabled, data is aggregated and anonymized -it is never linked to your wallet, your identity, or your Bitcoin activity.
Analytics never include:
- Wallet addresses or public keys
- Account balances or UTXO data
- Transaction amounts, destinations, or history
- Seed phrases or any key material
- Private keys or derivation paths
- Personal identity, name, or location
TZUR Wallet does not include advertising SDKs, third-party tracking technologies, or fingerprinting libraries. We do not sell, share, or monetize any user data.
Responsible Disclosure
If you discover a security vulnerability in TZUR Wallet, please report it to contact@tzur.live. We take all reports seriously and will respond promptly. Please do not publicly disclose vulnerabilities before they have been addressed. We are committed to fixing confirmed security issues as quickly as possible and will credit researchers who report valid findings, if desired.
Last updated: April 2026