Self-Custodial Access Control

Self-custody means one thing: you hold the only key. Not a password the provider can reset, not an account an administrator can open. A signing key that lives on your device, that Untrace never sees, and that every shard release depends on.

This page explains what that means in practice, and what it costs.

What does self-custodial mean for my files?

With a normal cloud drive, the provider controls access. They check your password against their database, and their administrators can reset it, bypass it, or be ordered to. Your access is a permission they grant.

With Untrace, access is a mathematical consequence of holding your key. Shard nodes release fragments only when a retrieval request carries a valid signature from your DID passkey wallet. There is no password table to breach, no reset flow to abuse, and no administrator who can open your vault, because no administrator holds anything that opens it.

The comparison people reach for is Bitcoin, and it is accurate: the same custody model that protects private keys protects your files. Whoever holds the key holds the data. You hold the key.

How does a retrieval actually work?

Your device builds a retrieval request for a specific object, scoped to a one-time nonce so it cannot be replayed.
Your passkey signs it. The signature happens on your device; the key never leaves it.
Each shard node independently verifies the signature against the vault's access policy before releasing its shard.
Your device collects enough shards to cross the threshold, reconstructs, and decrypts locally.

Every node checks for itself. A single compromised or dishonest node can refuse to release its own shard, but below the threshold that shard is useless anyway, and the node cannot release what it does not hold: a complete file. The full verification detail is in Security and Zero Knowledge.

How do I share a file without giving up custody?

Access is granted to a Decentralized Identifier, not to an email address or a link that anyone can forward.

You add the recipient's DID to the vault's access policy, with the permissions and expiry you choose.
Nodes then accept that DID's signed retrieval requests, and only for what the policy allows.
Revoking is a policy update. The recipient's access ends without you rotating keys or re-uploading anything.

A leaked link is a common way cloud files escape. Here there is no link that grants access, only signatures checked against a policy.

What happens if I lose my key?

This is the honest cost of self-custody, and it deserves a straight answer: there is no administrator who can reset your access, which means there is no administrator who can rescue it either.

Untrace reduces the risk in two ways:

Passkeys instead of seed phrases. Your key lives in your device's secure hardware behind Face ID or fingerprint, synced by your platform's passkey mechanism, with nothing to write on paper and lose.
Multiple authenticators. You can register more than one device and recovery path in advance, so losing one phone is an inconvenience rather than a loss.

Set up recovery before you need it. Self-custody rewards preparation and does not forgive its absence.

Why is this safer than a password?

A password is a secret both you and the server know. A signature proves you hold a key that only you know.
Passwords are phishable; a passkey signature is bound to the site and the request, so there is nothing useful to type into a fake page.
Password databases are breached in bulk. There is no signature database with anything worth stealing.
A stolen session or leaked object ID is not enough to read anything, because every shard release requires a fresh signed request.

Combined with sharding, this closes the two ways storage usually fails: the provider being compromised, and the account being compromised.