Custody
You hold two of three keys. Orrerie holds one.
Who holds what, what each party can and cannot do alone, where a payment is while it is being converted, and the three limits you should know before you start.
Every wallet
- Browser keyYou hold it
- Recovery keyYour app holds it
- Co-signer keyOrrerie holds it
Any two of the three keys move money.
The keys
Every wallet needs two of three keys.
Three keys protect each wallet: the browser key, which you hold, the recovery key, which your Orrerie app holds, and the co-signer key, which Orrerie holds. Any two of the three keys move money, so Orrerie cannot move it alone. By default a customer's payment goes to Relay, a separate company that holds it for seconds to minutes and then delivers it into your wallet. Litecoin, Dogecoin, POL and TRX, and Bitcoin that you keep as Bitcoin, skip Relay and are paid straight to your wallet.
Your browser key
Unlocked only by your passkey, or by your wallet password, in a page on the dashboard. It rests encrypted on Orrerie's server, which cannot open it. You keep a backup of it as a file.
Your recovery key
Made by the Orrerie app on your phone and kept in the app's own backup words. Only its public part leaves the phone; it is never on a hosted page and is rebuilt only in the downloaded recovery tool.
Orrerie's co-signer
One key per merchant, kept on Orrerie's server. It signs only a movement that already carries your approval and passes your rules.
Who can do what
What each party can and cannot do alone.
| Who | Can do alone | Cannot do alone |
|---|---|---|
| Orrerie, with its one key | Refuse to co-sign a movement. | Move any money. It holds one key of three. |
| You, with your browser key and passkey | Approve a movement, which the co-signer then signs if it goes to a saved address and is within your limits. | Send to a new address before its 24-hour wait is over. |
| You, with your backup file and your app's backup words, and no Orrerie | Move your money with the downloaded recovery tool, apart from one exception for now on Bitcoin, Litecoin and Dogecoin. | For now, move money that reaches an old Bitcoin, Litecoin or Dogecoin address after a change of keys. |
| A thief with only a copied browser key | Take what is on a Solana or TRON wallet that is not yet activated. | Anything else. The co-signer needs a fresh passkey signature for every movement. |
Orrerie cannot freeze your money
When Orrerie restricts an account it declines to serve or to co-sign. That is never a hold on funds: with your browser key backup and your Orrerie app's backup words you can move them with the recovery tool, apart from one exception for now on Bitcoin, Litecoin and Dogecoin.
Without Orrerie
The recovery tool works without Orrerie.
The recovery tool is a download that runs from a saved copy on your own computer. With your browser key backup and your Orrerie app's backup words it can move everything in your wallets, using the networks' own public services, even if Orrerie no longer exists.
- The browser key backup is saved at sign-up and picked again so it is certain it exists, and the Orrerie app confirms the recovery key it made.
- The recovery key is never on a hosted page: it is rebuilt from the app's backup words only in the downloaded tool.
What your backup words can do
The recovery key is made from your Orrerie app's 12 backup words, which also restore your own Orrerie wallet. Anyone who has those words and your browser key backup with its password can move the business's money without Orrerie. The one-time code belongs to the first app that scans it, so check that your own app shows your business and the same 4 digits as the page before you go on. Keep the backup file off your phone. If the words may have been seen, replace the recovery key from the dashboard with an Orrerie account that has new backup words: Orrerie refuses a new key made from the same words.
One exception, for now
On Bitcoin, Litecoin and Dogecoin, money that reaches an old address after a change of keys moves only with Orrerie's co-signer: you move it from Wallets in the dashboard, not with the recovery tool alone.
In transit
The one stretch where a third party holds a payment.
While a payment is being routed it is held by Relay, a separate company. Orrerie never holds it.
That stretch lasts seconds to minutes. If Relay cannot route a payment it returns it to your own wallet on the payer's network, less the network cost of sending it back, and you then refund your customer. On Solana and TRON that wallet is protected by one key until you activate it, so Orrerie stops offering the network to payers once a wallet that is not activated holds more than a small sum.
A coin sent to a Relay address that Relay does not handle on that route may not be recoverable. The checkout says so above the address.
Litecoin and Dogecoin are not covered by Relay. They are paid straight to your own wallet and arrive unconverted.
Said plainly
Three limits, said in full.
A business in a browser is less protected than a user of the phone app.
For a few seconds per payout, your key is in a web page that Orrerie's server sends.
Before a payment arrives, Orrerie's servers decide where it is sent.
Incoming payments are directed by Orrerie's servers to your wallet address; your keys protect money once it has arrived.
While a payment is being converted it is with Relay, a separate company.
Relay is an outside routing service. From the moment a payer pays a Relay address until Relay delivers into your wallet, which takes seconds to minutes, the value is with Relay.
If someone took over that page and Orrerie's co-signing server at the same time, they could take the money of every merchant who approved something while it lasted. Nothing technical stops that pair. The saved-address rule, the waits and the daily limits hold against either one alone.
No outside firm has reviewed Orrerie Merchant. Every part that touches keys or money ends with an in-house attack review.
Compared with the phone app
How strong this is, beside the Orrerie phone app.
The phone wallet and the merchant wallet use the same two-of-three idea. The browser is the weaker place to hold a key, and this is how.
| Question | Phone app | Merchant in a browser |
|---|---|---|
| Where the first key rests | Encrypted on the phone, unlocked through the phone's secure hardware. | Encrypted on Orrerie's server. The unlocking secret is inside the passkey (secure hardware or a password manager) or is a password. |
| Where the key is while signing | Inside the app's own process. | In a page worker's memory for a few seconds. |
| Who fixes the code that touches the key | Orrerie, in a signed build that changes only when you install an update. | Orrerie's web server, on every visit. |
| What the approval prompt shows | The app's own review, then Face ID or a fingerprint. | The page's review. The passkey prompt itself shows only the site name. |
| What a stolen first key can do alone | Nothing. It needs the co-signer or the recovery card. | Nothing on the nine networks whose two-of-three is in force. Everything on a Solana or TRON wallet that is not activated, which the product keeps to small sums. |
| What Orrerie's own storage can do alone | Nothing. The phone key never reaches it. | Nothing. A passkey lock needs your authenticator; a password lock needs a secret that never left your browser. The co-signer key is one of three. |
| What stops a thief with the first key and a signed-in session | An extra seal on large payments. | Saved addresses only, a 24-hour wait on a new one, daily limits, a fresh passkey signature for each payout, and an email on every change. |
| What stops whoever controls Orrerie's web server and its co-signer | They still need the phone's key, which they cannot reach. | Nothing technical, for a merchant who approves a payout while the bad page is being served. This is the real gap. |
If one part is broken into
What a single break-in can and cannot do.
A break-in that replaces the dashboard's code and also controls the co-signer can take the funds of every merchant who approves anything while it lasts. What narrows that gap:
- No third-party code on the dashboard.
- Signed releases, and a monitor outside Orrerie's servers that checks the served files.
- The release key kept off the server.
- The downloaded recovery tool, which needs no hosted page at all.
Orrerie makes that choice need two separate parts of its system, and watches it from outside. A break-in of both parts, or of the checkout page itself, could misdirect a payment before it reaches you.
| Break-in | What it can do | What it cannot do |
|---|---|---|
| Only the served page, or a thief with one merchant's session, key and passkey taps | Send up to that merchant's daily limit to an address already on its saved list. Take the balance of a Solana or TRON wallet that is not activated. Start a change of keys, which then waits 72 hours or 7 days with emails to every owner and a link to cancel. While you make your wallets, pair its own Orrerie app instead of yours, which gives it two keys of three: your own app then never shows Recovery key confirmed, and every owner gets an email naming the app account that confirmed. If that account is not yours, freeze and take no payments into those wallets. | Add a destination without the 24-hour wait and its emails. Replace a key without the wait. Move anything past the limits. Touch another merchant. |
| Only the co-signer of one merchant | Refuse to sign. | Sign alone. It holds one key of three. |
| Only a merchant's browser key, copied | Everything on a Solana or TRON wallet that is not activated. | Anything else. The co-signer needs a fresh passkey signature for each movement. |
One more limit
Screening happens after a payment arrives.
A payer's address is screened against sanctions lists once the money has arrived, because only then is the sender known. Screening can flag a payment; it cannot prevent one.
Hold your own keys from the first order.
The backup is saved and the Orrerie app confirms its recovery key before the first real payment.
The pictures on this page show the built product with a test business and simulated payments.