CUCUTalk to an engineer

Custody infrastructure,
in your own AWS account.

CUCU deploys and operates key custody, signing and audit-ready infrastructure for crypto and stablecoin companies. You own the account and the keys. We run it.

Talk to an engineerSee the architecture
Example · transfer request to your signer
$ curl -X POST https://custody.internal/v1/transfers \    -H "Idempotency-Key: 7f3c…e91a" \    -d '{      "asset":  "USDC",      "chain":  "base",      "to":     "0x4b2e…9c07",      "amount": "2500.00"    }'
{  "id":       "trf_01JB7Q…",  "status":   "awaiting_approval",  "policy":   "treasury · 2 of 3",  "key":      "kms · hsm-backed",  "audit":    "evt_9QK2…"}
HSMs holding every production key (AWS KMS)
FIPS 140-3 L3
private keys in application memory
0
of infrastructure changes as reviewed commits
100%
billing, data and keys never leave it
Your account

01 — Platform

Three pieces. One operator.

01

Custody

Keys are generated in an offline ceremony and held in AWS KMS. A single isolated signer is the only service allowed to sign. Treasury moves behind multisig policies; every customer gets derived deposit addresses.

  • AWS KMS · secp256k1
  • Isolated signer
  • Multisig treasury
  • Per-customer addresses

02

Foundation

A multi-account AWS landing zone built to be handed to an auditor: encrypted Postgres with point-in-time recovery, secrets in Secrets Manager, immutable audit logs and least-privilege access by default.

  • Multi-account landing zone
  • RDS · PITR
  • Secrets Manager
  • Immutable audit trail

03

Operations

Everything runs through GitOps on EKS or ECS, so every change is a reviewed commit you can read. An AI operator watches the system around the clock; an engineer is on call behind it.

  • GitOps
  • EKS or ECS
  • OpenTelemetry
  • Human on call

02 — Architecture

The boundary is your AWS account.

Your application talks to one API. Behind it, a policy engine decides, the signer signs inside KMS, and chain watchers settle every movement into a double-entry ledger. Nothing in the box runs on our infrastructure.

  1. Your app
    request
  2. Custody API
    check
  3. Policy engine
    approve
  4. Signer → KMS · HSM
    broadcast
  5. Blockchains
    observe
  6. Chain watcher
    settle
  7. Ledger · Postgres

Networks

  • TRONUSDT
  • BaseUSDC
  • EVM chainson request

03 — How it works

From empty account to first signature.

  1. 1

    Deploy

    We install the platform into a fresh AWS organization you own, from Terraform you can read and keep.

  2. 2

    Key ceremony

    Production keys are created on air-gapped hardware, wrapped into KMS, with an encrypted backup held outside AWS.

  3. 3

    Operate

    We run, patch and monitor it for a monthly fee. You keep root access, the code and the audit trail.

Fixed setup plus a monthly operating fee, quoted per scope.

04 — Principles

What we will not compromise on.

We never hold your keys.
Keys live in HSMs inside your account. We operate the system; we cannot move your funds alone.
No proprietary lock-in.
Terraform, Kubernetes, Postgres. If you part ways with us, the platform keeps running.
Everything is a commit.
Infrastructure, policies and releases are declared in Git and reviewed before they reach production.
Evidence over claims.
Logs, diffs and ceremony records you can hand to an auditor, instead of badges on a website.

Bring us your hardest key-management problem.

One conversation with an engineer, no sales deck.

[email protected] →or WhatsApp +1 (307) 533-4392