Security

Para’s security model is built on a simple principle: no single party (not Para, not the integrating application, not even the user’s device alone) ever holds a complete private key. This eliminates the most common attack vectors in wallet infrastructure and provides a foundation that compliance and security teams can trust.

​

Security at a Glance

​

Why This Matters

For product teams: Non-custodial wallets unlock capabilities that custodial models can’t offer: For compliance and risk teams: Para’s non-custodial architecture means the integrating application can move faster, minimizing licensing obligations that come with custodial wallet models. Every transaction is checked against an approved permissions policy before signing, creating an auditable enforcement layer. For security teams: Threat models are significantly reduced. Integrating applications don’t store private keys, so a breach of their infrastructure doesn’t expose user assets. Para’s MPC signing ensures that even a compromise of Para’s systems alone cannot produce valid signatures.

​

How Keys Are Protected

Para uses a 2-of-2 Multi-Party Computation (MPC) system where the private key is split into two shares (one on the user’s device, one in Para’s cloud HSMs). To sign a transaction, both shares participate in a cryptographic ceremony that produces a valid signature without ever reconstructing the full private key. Neither Para nor the integrating application ever sees the full key. This is true during key generation, signing, and recovery.

​

Authentication

Para supports multiple authentication methods to fit different user bases and product requirements.

​

Email and Social Logins

​

Additional Account Protection Options

These options can be layered on top of authentication to provide additional security when authorizing transactions.

​

Session Management

Para uses sessions as a security measure when signing transactions. Session length is configured per API key, enforced by the Para API, and can be adjusted in the Security section of the Developer Portal or CLI.

​

Encryption and Secure Communication

All communication between the user’s device, Para’s servers, and connected applications is encrypted:

• TLS for all network communications
• End-to-end encryption for sensitive data in transit
• Encryption at rest for all stored user data

​

Censorship Resistance

Para’s architecture ensures users maintain control over their assets even if Para’s services are unavailable:

• Users can export their Para Share at any time via
• With both shares, users can sign transactions independently without Para’s servers
• The provides a censorship-resistant fallback for full self-sovereignty

This design ensures that Para cannot censor transactions and that users are never locked out of their own assets.

​

Backup and Recovery

Device loss, theft, and hardware failure are inevitable. Para’s recovery system ensures users can always regain access to their wallet without the need for application-level recovery flow build-outs. All recovery flows are handled through the Para Portal, a managed web experience that walks users through verification and key restoration.

​

Security Measures

​

Best Practices for Users

​

Audits and Compliance

Para is SOC 2 Type II compliant and regularly undergoes system-wide audits and penetration tests covering MPC implementation, infrastructure, API security, and recovery flows.

​

Security FAQs