Biaka Wallet Security Architecture
Three simple rules define Biaka's trust model:
Recovery Phrase
= wallet recovery. The 12 words derive every account, deterministically, on your device.
PIN
= local unlock & authorization. It protects the app on this device only and never leaves it.
Biometric
= convenience unlock. Hardware-gated shortcut; the PIN remains the fallback, always.
What the backend can never do
Our servers hold no seed, no keys, no PIN. They cannot recover a wallet and cannot sign a transaction — this is enforced by architecture, not by policy.
How a transaction happens
- Local signing — transactions are built and signed inside the app's native security core on your phone.
- Secure confirmation — before any signature, a dedicated screen shows the asset with its network (e.g. "USDT · TRON"), the full recipient address, amount and maximum network fee, and requires your PIN.
- Wrong-network protection — an Ethereum address in a TRON transfer (or vice versa) is rejected before anything is signed; QR scans only accept addresses valid for the network being sent on.
- Hardware-backed storage — secrets are sealed with Android Keystore hardware keys on the device.
- Encrypted metadata sync (optional) — the address book syncs as ciphertext sealed on your device; the server cannot read it, and it is not a wallet backup.
External security audit has not yet been completed. Public launch is proceeding under an owner-approved risk acceptance based on completed internal security review, production hardening, and limited-mainnet validation.