Two of three must agree. The fourth only watches.
A signature leaves Roost only when at least two of the three voting chips produce it for the same request. A fourth device stands beside them and signs nothing.
Watch
Roost in 35 seconds.
The box, the chips and the quorum.
The signing path
Every request takes the same four steps.
An application, a person or an AI agent asks Roost to sign or to unwrap a key.
Roost checks the key's policy: who may use it, for what, how often, and whether a passkey approval is required.
The monitor logs the request and can block it before it reaches the voters.
The voters sign. Two matching results make a signature, which is recorded in the chain.
Quorum
Built to survive a failure and to refuse a takeover.
One fails, signing continues
If a voter stops, the other two still make a quorum, and signing goes on until the unit is replaced.
One is compromised, nothing is signed
A single voter can never reach the quorum alone. Whoever takes over one chip still holds only one of the two signatures required.
The monitor does not sign
The monitor is a separate device with no signing key. It records every request, detects anomalies and blocks a request before it reaches the voters.
Keyless
The key is not stored. It is regenerated.
Every voter carries a PUF, a circuit that reads the microscopic manufacturing variation of its own silicon. At power-up it regenerates the same key from that variation, and when power goes the key goes with it. There is no key file, no fuse and no backup to copy.
The chip wakes up.
The same key, from the same silicon.
Two of three agree.
The key is gone.
Shared keys without a shared secret
Keys that must survive a failure are split, not copied.
A key that needs a backup is split into pieces. Each chip locks its own piece with its own fingerprint, and any two pieces rebuild the key. No complete key is ever stored, and a backup box receives only pieces, with approval from several administrators.
- One stolen piece is useless.
- One failed chip does not lose the key.
- No domain secret is carried by people.
- Adding a backup box needs a multi-person passkey approval.
Approvals and records
Who allowed it is part of the signature.
- Approvals are passkey signatures bound to the exact content: title, body hash, attachments and decision.
- Every signature, refusal, approval and tamper event is a sealed record in a hash chain.
- Auditors verify the chain themselves instead of trusting a log file.
- Records also leave the box, so they survive even if the box is destroyed.
- Every seal carries a counter that only moves forward, so an old signature cannot be replayed as a new one.
- Signatures for third parties are public-key signatures: anyone with the public key can verify them without trusting Axowl.
What Roost never does
Seven things that are not configurable.
- Never exports a private or secret key, in any format, to anyone.
- Never signs without two of three chips agreeing.
- Never signs a sensitive key's request without the approval the policy demands.
- Never offers a weak algorithm or an unauthenticated mode.
- Never writes a secret to a log, a report or an error message.
- Never opens an outbound connection on its own.
- Never gives Axowl a way in on its own: no master PIN, no support key, no unlock without your owners' passkeys.
See Roost refuse an unapproved signature.
A 30-minute live demo with our engineers.