Security and current evidence

Secrets and signing stay local

Halyard is designed to generate or import recovery material on the client, encrypt it on the device, and use it locally for signing. Protect your device, wallet password, recovery phrase, and backups.

Public data used for network requests

Balance requests send public account or contract addresses to the selected RPC provider or Halyard service. Risk checks may send the account or contract being checked. Price requests use asset identifiers. Blockchain activity is public by design.

Backup and recovery boundaries

Backups are optional. Confirm that you understand which passwords and files are required before relying on them.

• New paper backups use the versioned v2 format and require a strong passphrase of at least 12 characters.
• Legacy 4-digit PIN paper backups can be read for recovery but are not offered for new exports.
• Google Drive stores an encrypted backup under your Google account. Uninstalling Halyard does not necessarily delete it. Recovery still requires the backup password and each original wallet password.

Device protections have limits

Halyard uses available operating-system storage, biometric prompts, and screen protections. Their behavior depends on the platform, device state, and system settings, so they do not replace a strong password and safe recovery-phrase storage.

Warnings support your review

Transaction and dApp warnings highlight known risk signals. They cannot prove that a contract, site, route, or transaction is safe. Read the network, recipient, amount, approval, and fee before signing.

Audit and bounty status

Internal validation is ongoing. Halyard does not currently publish an independently verified external audit report or a public bug-bounty program on this site.