UMBRA
Shadow Protocol
The protocol of absolute silence.
UMBRA protects what must survive an adversary who holds every advantage — physical possession of the hardware, effectively unlimited computation, and the legal authority to compel your cooperation. It keeps assets in absolute operational silence: no network traffic, no disk activity, no power signature, no electromagnetic emission. There is nothing to intercept, nothing a subpoena can turn into access, and nothing that proves the vault holds anything at all. Absence itself is the defense.
Six protocols, absolute silence.
Signal Elimination
Distributed Custody
Compelled-Cooperation Resistance
Hardware Time-Lock
Custody Proof Without Access
Unsealing Ceremony
Built for the adversary
who holds every advantage.
UMBRA is designed around the worst-case adversary — one with physical possession of the vault hardware, effectively unlimited computational power, and the legal authority to compel the people who hold it. Against that adversary the secrecy of a password is not enough, so UMBRA removes the signals, separates the authority, and enforces the delays that make possession and compulsion insufficient. Even in complete physical control of the device, an adversary cannot determine whether assets exist, what they are, or when they were placed there — without assembling a threshold of separated custodian shards.
Total signal removal — on sealing, all network, USB, wireless, and power-analysis surfaces go dark, so there is no channel left to observe or attack.
Ciphertext at rest — volatile memory is wiped during sealing and only encrypted material remains, so seizing the storage medium yields nothing usable.
Separated authority — custodian shards are held apart and never colocated, so no single location, person, or order can reconstruct control.
Enforced delay — a hardware time-lock guarantees access is never instantaneous, defeating coercion that depends on immediacy.
What it does, in the field.
Deterministic Cold Storage
Treasury reserves and strategic assets held in absolute silence, under an authority you control and no one else can reconstruct. No custodian, exchange, or third party can move, pledge, or even observe the holdings.
Air-Gapped Key Material
Master keys, signer shards, and recovery seeds sealed behind no live interface of any kind. The material cannot be exfiltrated remotely because there is no remote surface that reaches it — retrieval requires physical unsealing.
Catastrophic-Scenario Survivability
Assets structured to outlast the failure of any single site, custodian, or jurisdiction. Because authority is separated and never colocated, the loss of one location or holder neither compromises the vault nor loses it.
Technical Interfaces
Generates a zero-knowledge Merkle proof of reserve inclusion for a specific asset without revealing vault contents, unlocking, or breaking silence.
{
"asset_id": "btc-utxo-8819",
"state_root": "0x4a9b2...",
"requester_pubkey": "03a1b..."
}Initializes the unsealing ceremony, requiring physical multisig inputs from at least 3-of-5 authorized shard holders to begin the time-lock countdown.
{
"ceremony_id": "crm-7731",
"shard_signatures": ["sig1...", "sig2...", "sig3..."],
"intent_hash": "0x88f1..."
}Architect absolute silence.
UMBRA vaults are physically independent units with no shared infrastructure, each operating in complete isolation and answering the worst-case adversary with absence rather than trust. Contact our custody operations team to scope a vault provisioning.