Self-custody you can check for yourself.

Plenty of services call themselves non-custodial. Usually that means a promise: the operator could move your funds but says it will not. A promise is only as strong as the breach that tests it.

We remove the ability instead of resting on that promise. Our backend prepares an unsigned transaction and broadcasts the signed one, and that is all it can do. No endpoint signs for you, and none opens your backup, because that code was never written. Disabling such a path would still leave it in the codebase, so the honest answer to “can they sign as me” would stay yes.

Think of a teller who holds no key to the vault, instead of one who holds a key and pledges restraint. There is no key to misuse, so nothing rests on the pledge.

Because the capability is absent, anyone can read the code and confirm it. Non-custody becomes a fact you can verify.