Nothing here depends on trusting us
Every control below is either physical, mathematical, or witnessed by someone who does not work for us. Where a control depends on our good behaviour, we have said so.
Six things standing between your box and the street
-
Dual control
The strongroom lock takes two keys turned within four seconds of each other. We hold one. There is no master.
-
Identification at the door
Biometric verification against the record taken when you signed. A match is required before the corridor door releases.
-
Seismic monitoring
Geophones in the walls and floor slab, monitored continuously off site. Drilling and cutting register long before they breach.
-
Append-only register
Entries are written, never edited. A correction is a new entry that supersedes the last, and both remain visible.
-
Underwritten cover
All-risks cover placed at Lloyd's, backed by the reserve held against your class of holding.
-
Attended transit
Movement between strongrooms travels in a crewed armoured vehicle, sealed at both ends and reconciled on arrival.
What an access session can and cannot do
A live session is a read of the register. We built it this way on purpose: the convenience of checking is worth having, the convenience of moving is not.
- Access number and PIN
- The PIN is stored only as a one-way hash. Nobody here can read it back, including the person who issued it.
- One-time code
- Correct credentials trigger a code to the address on file. Credentials alone are not enough.
- Attempt limits
- Three wrong PINs lock the box for an hour and notify you. Repeated attempts from one network are throttled separately.
- A duress PIN, if you want one
- A second PIN that opens a restricted register and silently alerts the vault office. The screen looks normal.
- Access windows
- You can restrict your box to certain hours, days or networks. Outside them, correct credentials still fail.
The awkward questions
What can a Golgatha employee do on their own?
Reach the corridor, and open an empty box. They cannot open an assigned box without the holder's key, and no single member of staff can authorise a release. Attempts are logged against the individual.
Could someone with database access see my PIN?
No. PINs are stored as salted one-way hashes. A full copy of the database would let someone try to guess PINs offline, which is why we rate-limit, lock out, and require a one-time code as well.
What happens in a fire or flood?
The strongrooms are rated for four hours at 1,100°C and sit above the hundred-year flood line. Holdings are insured against both regardless.
Who audits you?
An independent registrar reconciles a random ten per cent of boxes each quarter, and the full register annually. The report is available to holders on request.