{"version":"1.0.0","summary":"Non-custodial of your wallet and its keys: Cofferline never holds the owner key of, or takes custody of, your connected smart account, and executes only within an owner-signed, expiring, on-chain-revocable delegation. Enumerated exceptions — prepaid fee balances (platform-held USDC), auto-topup authorizations, and optional venue trade credentials (a Polymarket signer is held authority over your funder Safe) — are set out in the custody matrix.","surfaces":[{"id":"wallet_signin","surface":"Wallet sign-in (SIWE identity)","platform_holds":"Nothing that moves value. A SHA-256 hash of each session/API-key token; the wallet signature itself is verified and discarded.","authority":"Proves identity for API access. Moves no funds and signs no transaction.","bound":"cryptographic","max_exposure":"API access as you, until keys are revoked — no ability to move funds or sign on-chain.","customer_holds":"Your wallet and its keys.","revocation":"Revoke the API keys it minted (DELETE /v1/keys/{id}); sessions expire on their own (24h). No on-chain step, no Cofferline cooperation needed.","third_party":"None.","on_termination":"Sessions and keys are revocable/expiring; no funds are implicated."},{"id":"delegation","surface":"Session-key delegation (core treasury: conversions, gas top-ups)","platform_holds":"The executor signing key (generated and held inside a hardware TEE at a key-management service — never in application compute). It can act ONLY inside a session key installed on YOUR own ERC-4337 (Kernel) smart account.","authority":"Execute an owner-allowlisted set of (target, selector) calls with a per-call native-value cap, a hard expiry (≤90 days), and an optional op-count rate limit. Funds stay in your account throughout.","bound":"cryptographic","max_exposure":"Bounded on-chain by the account's CallPolicy AND a signer-side policy: worst case is a swap through an allowlisted venue router with hostile calldata, capped per swap by the approve cap (USD-stables) or the token balance (non-stables), and cumulatively by the grant's rate limit where set, else by expiry and your revocation. `transfer` is never granted; an approve to a non-venue spender fails in the account itself.","customer_holds":"Your smart account, its owner key, and all funds in it.","revocation":"Revoke the delegation on-chain from your owner key at any time — it is your own transaction and NEVER requires Cofferline's cooperation.","third_party":"Venues (CoW Protocol, ParaSwap) execute the swap; a TEE key-management service holds the executor key.","on_termination":"Suspension/termination stops Cofferline from acting; your delegation and funds are untouched and you revoke on-chain independently."},{"id":"x402_fee","surface":"Direct x402 fee (EIP-3009 exact-amount USDC payment)","platform_holds":"After settlement, the paid USDC lands in the treasury EOA (EXECUTOR_ADDRESS). This is a fee paid TO the platform, not custody of your wallet.","authority":"Move exactly the signed amount, once, to the treasury payTo address. The authorization is single-use (nonce) and exact-value.","bound":"cryptographic","max_exposure":"The one exact amount you signed for. A replay cannot double-charge (nonce).","customer_holds":"Your wallet; you choose each amount and each signature.","revocation":"Sign `cancelAuthorization` on-chain before it settles — unilateral, no Cofferline permission needed.","third_party":"None beyond the USDC contract and the chain.","on_termination":"A settled fee is a completed payment; unsettled authorizations you can cancel."},{"id":"prepaid_balance","surface":"Prepaid balance (platform-held service deposit)","platform_holds":"REAL USDC. A top-up settles on-chain into the treasury EOA (EXECUTOR_ADDRESS) FIRST, then credits an internal balance. That internal balance is a service credit the platform administers — platform-held funds, not a segregated custody account. There is no omnibus account over your wallet and no sweep path, but the prepaid float itself is money the platform holds.","authority":"Debit your internal balance for metered fees at the published pricing.","bound":"application","max_exposure":"The prepaid balance you have funded. It is spent only on your own metered usage; it cannot be moved to a third party.","customer_holds":"A claim to the service credit (refund/redemption terms are stated in the Terms).","revocation":"Stop topping up. You do not pre-authorize the platform to pull more than each signed top-up; disposition of a remaining balance on termination is governed by the Terms.","third_party":"None; funds sit in the platform treasury.","on_termination":"Remaining prepaid balance is handled per the Terms' termination clause. It is platform-held throughout, so recovering it depends on the platform, not an on-chain revocation."},{"id":"auto_topup","surface":"Auto-topup authorizations (pre-signed bearer arrows)","platform_holds":"A set of fixed-value, fixed-recipient (the treasury) EIP-3009 signatures, each usable exactly once, with its own expiry.","authority":"When your balance drops below your threshold, settle the next pre-signed authorization to pull that fixed amount of your USDC into the treasury. Capped at a per-calendar-month maximum (default 10).","bound":"mixed","max_exposure":"The sum of the outstanding authorizations you pre-signed, bounded by their per-arrow value and expiry and the monthly cap. Each arrow can only ever move payer USDC to the treasury — it is a payment instrument, not custody.","customer_holds":"Your wallet; you pre-sign each arrow and control cancellation on-chain.","revocation":"Cancel any outstanding nonce on-chain via `cancelAuthorization` (unilateral). NOTE: DELETE /v1/balance/auto-topup removes the stored authorizations from Cofferline but does NOT revoke them cryptographically — the response returns the exact CancelAuthorization calldata for each outstanding nonce, which you submit on-chain.","third_party":"None beyond the USDC contract and the chain.","on_termination":"Stored arrows are deleted on rule removal; any already broadcast is a completed payment. Cancel unspent nonces on-chain to be certain they can never settle."},{"id":"coordinator_payload","surface":"Transaction coordinator (sealed signed-transaction envelope)","platform_holds":"An AEAD-sealed envelope of an already-SIGNED transaction (encrypted at rest like the venue credential, compacted to a hash tombstone after the audit window). Sealed because a signed-but-unconfirmed transaction is broadcastable by anyone.","authority":"Rebroadcast that EXACT signed transaction for its one authorized effect. It cannot be altered to authorize any different effect — the signature commits to the exact call.","bound":"cryptographic","max_exposure":"Exactly the one effect the transaction was already signed for. The envelope confers no ability to sign anything new.","customer_holds":"The account the transaction acts on; the effect is one you (or your delegation) already authorized.","revocation":"Standard on-chain means for a pending transaction (e.g. nonce replacement) apply; the effect is bounded to what was signed.","third_party":"The chain.","on_termination":"Envelopes are tombstoned to a hash after the audit window."},{"id":"polymarket_hosted","surface":"Polymarket hosted credential (held authority — the weakest bound)","platform_holds":"A sealed (AES-256-GCM, tenant+venue-bound AAD) trade-signer key that, by Polymarket's own wallet model, is the 1-of-1 OWNER of your funder Safe. Write-only — no endpoint returns it — in the single venue_credentials table.","authority":"Cofferline confines its use to orders, authenticated reads, and collateral wrap — but that confinement is APPLICATION POLICY, not a cryptographic bound. The key itself can sign `execTransaction` against the funder Safe for anything: transfers, approvals, owner changes.","bound":"application","max_exposure":"Full control of that ONE funder Safe, bounded only by what it holds, IF the sealed store is compromised (database AND sealing key together). This is disclosed, accepted trust model parity with every Polymarket integrator — mitigated by a dedicated funder, per-use audit + volume alerting, and rotation.","customer_holds":"Your funder Safe and its collateral (until a compromise) — and always the ability to rotate its owner yourself.","revocation":"Revoke via API (zeroes the ciphertext — helps before theft, never after). Rotate the signer with the `swapOwner` calldata from GET /v1/pm/credentials/{id}/rotation, which YOU execute from your funder Safe — Cofferline can never submit it. Keep only working trading balances in a dedicated funder.","third_party":"Polymarket / the funder Safe on Polygon.","on_termination":"Revocation zeroes the material. An already-exfiltrated key is out of Cofferline's control — rotate the Safe owner to be safe. Order transmission is dev-gated in production."},{"id":"pm_funder_collateral","surface":"Polymarket funder collateral","platform_holds":"Nothing directly — collateral stays in your own funder Safe. But note the Polymarket signer above IS that Safe's owner key, so the held-authority exposure of that row reaches this collateral.","authority":"None on the collateral directly; only via the funder Safe's owner signer (the row above).","bound":"application","max_exposure":"As per the Polymarket hosted credential row — full Safe control on a store compromise.","customer_holds":"The funder Safe and its collateral.","revocation":"Rotate the Safe owner (see the Polymarket credential row); move balances to a fresh funder.","third_party":"Polymarket / the funder Safe on Polygon.","on_termination":"Collateral is yours in your Safe; rotate the owner if a credential was ever held."},{"id":"platform_treasury","surface":"Platform treasury / relay EOA (Cofferline's own funds)","platform_holds":"The treasury/executor EOA (EXECUTOR_ADDRESS) and the platform's own funds in it. It receives x402 fees and prepaid deposits, pays gas, and relays collateral wraps and payment settlement. The signing key is TEE-held at a key-management service and policy-locked to exactly those shapes.","authority":"Spend the platform's OWN funds and relay the allowlisted transaction shapes. It CANNOT move funds out of your accounts — no signature exists that would let it, and the on-chain session-key scope plus the signer-side policy reject anything else.","bound":"cryptographic","max_exposure":"This is custody — of the PLATFORM'S own treasury, not of your wallet. Your delegated accounts and funder Safes are outside its reach.","customer_holds":"Your own wallet/accounts — this row is platform-owned funds, not yours.","revocation":"Not applicable — these are the platform's funds. Your protection is that the treasury key has no authority over your accounts.","third_party":"A TEE key-management service (holds the key); the chain.","on_termination":"Platform-internal."}]}