Managing Crypto Keys in a Small Firm: Who Has Access and How to Check
Managing Crypto Keys in a Small Firm: Who Has Access and How to Check
Key takeaways:
- Map who has access to which key and update that list regularly.
- Separate roles: one person approves a transaction, another executes it.
- Document access procedures and store them in a secure place.
- Practice access recovery before you need it, using test amounts.
- Security is measured by the level of risk, not absolute guarantees.
In a small firm, managing crypto keys often rests on a few people and informal agreements. The problem arises when a key person leaves, forgets a password, or makes a mistake in a transaction. This article provides a practical framework for internal hygiene: how to know who has access, how to share responsibilities, and how to verify that your recovery system actually works.
The focus is on processes, not tools. Whether you use hardware wallets, software solutions, or paper backups, the principles are the same: clarity, separation of duties, and regular checks.
Step 1: Create an Access Map
The first task is to write down every key the firm uses: for the main account, for operating expenses, for test purposes. Next to each key, list who has access, in what form (seed phrase, password, hardware device), and where the copy is stored.
- Use a table or document stored offline, e.g., in a safe.
- Mark the date of the last check and the name of the person who performed it.
- Remove access for former employees immediately upon termination of employment.
The access map is not static. Update it after any staff change, after purchasing a new device, or after any suspicion of compromise.
Step 2: Separate Duties
One person should not be able to both execute and approve a transaction alone. In a small team, this means: one person prepares the transaction, another reviews and approves it, and a third (if available) holds a backup copy of the key, but that copy alone must not be sufficient for signing; use multisig or physical dual control for safe access.
For larger amounts, use a multisig wallet with 2-of-3 or 3-of-5 signatures, requiring agreement from multiple people. For smaller operating expenses, you can have a single key, but then clearly define the limit and the procedure for any amount above it.
It is crucial that the separation of duties is documented in an internal policy, even if the firm is small. This prevents misuse and reduces the risk of error.
What to Document and Where to Store It
Documentation is tedious but necessary. Keep a log of key events: when a key was created, who had access, when a password was changed, when a transaction larger than usual was executed.
- Store seed phrases on paper or metal, in multiple copies, at different locations.
- Keep passwords in a password manager with strong master passwords, but never alongside the seed phrase.
- Define who has the right to access copies in the safe and record this in the access map.
Do not store everything in one place. Multiple copies protect against loss but increase the attack surface. If you suspect that any copy has been seen by an unauthorized person, move the funds to a new key.
How to Verify Access Recovery
Access recovery is not tested when you need it. Practice it in advance, using a test wallet with a small amount of funds. Procedure: delete the wallet from the device, then try to restore it using the seed phrase and the procedures you have documented.
Record the time needed for recovery and any issues that arise. If someone does not know where the copy is or the password is wrong, that is a signal that the system needs fixing.
Perform this exercise at least once a year, or after any major team change. If you succeed with test funds, the procedure is verified for those conditions; repeat the test after any change in team or equipment.
Regular Review and Response to Changes
Once a quarter, go through the access map and check that it is still accurate. Ask: are all listed individuals still employed? Have procedures been updated after the last change?
If you notice a suspicious transaction or suspect that a key is compromised, immediately move the funds to a new wallet with a new seed; changing the password does not help if the seed phrase is compromised. Do not wait for the problem to be confirmed.
Consider professional liability insurance for individuals managing keys, but that is a topic for a legal advisor, not this article.
Related Articles
Frequently Asked Questions
How often should the access map be updated?
At least once a quarter, or immediately after staff changes, purchasing a new device, or suspicion of compromise.
What if the firm has only one person who knows everything?
That is a high risk. Consider a multisig wallet or at least storing a copy with a trusted person outside the firm, with clear procedures.
Is a paper copy of the seed phrase safe?
Paper is an acceptable risk if stored in a safe with access control; metal plates further reduce the risk of fire and water damage.
How do I know that access recovery is successful?
Test it: delete the wallet and restore it using your procedure. If you succeed with test funds, the procedure is verified for those conditions; repeat the test after any change in team or equipment.
What to do if an employee who knew the key leaves the firm?
If the person knew the seed phrase or had access to the private key, immediately move the funds to a new wallet with new keys; the old key cannot be revoked or have its password changed. Then update the access map.