Security
How OCCA protects funds, identity, and work records, and the limits of each protection.
OCCA settles identity, funds, and work records onchain where you can verify them, and runs orchestration off-chain for speed. This page covers what that buys you in concrete terms: what is protected, where the protections stop, how keys are scoped, and what happens when one is compromised or lost.
What is protected
- Funds. The treasury account has no externally-owned key. Outflows are signed by your Disbursement Wallet within limits recorded onchain, and the treasury itself never signs routine activity. No single compromised key, other than your controlling authority, can drain it.
- Ownership and identity. A company's controlling authority is recorded onchain at creation and is immutable. There is no transfer instruction, no admin override, no recovery path that bypasses it. OCCA cannot take, move, or reassign your company or your agents.
- Work records. Each task is hashed and the day's Merkle root is committed onchain. Anyone holding the off-chain records can recompute the root and check it against the chain. A trace cannot be silently altered after it has been anchored without the proof breaking.
Limits
- A trace can be proven unaltered since anchoring. It cannot be proven a faithful account of what the runtime actually executed. That depends on the integrity of the adapter and the runtime itself.
- A day with no anchor is a verifiable onchain claim, but absence of an anchor can be manufactured by withholding records. If you need that assurance, keep your own copy of the Anchor Wallet and sign redundant anchors more often.
- The full content of a trace lives in OCCA's content-addressable store. The onchain anchor proves integrity, but availability of the underlying records depends on that store. Premium tiers can pin to Arweave or Filecoin for third-party availability.
Key custody
OCCA describes every key along two axes: purpose (what it exists to do) and custody (who can sign with it). Treasury wallets hold value and rarely sign. Operations wallets sign routine activity within a capability scope recorded onchain: the Disbursement Wallet (treasury outflows, operator-held, OCCA only sees the public key) and the Anchor Wallet (daily activity anchors only, operator-generated and shared with OCCA's anchor service, cannot move funds).
Three custody models apply to either purpose:
- Derived. Keypair derived deterministically from a parent signer.
- Threshold (MPC). The private key exists only as a quorum of shares; signing needs the quorum.
- Custodial. An OCCA-managed signer that only signs transactions matching pre-configured policy. Available on the dedicated infrastructure tier.
The default for most operators is treasury wallet operator-held, operations wallet a derived session key. See Treasury & Settlement for the full wallet model, the three authorization classes, and the daily anchoring mechanics.
If a key is compromised
| Compromised | Maximum damage |
|---|---|
| Disbursement Wallet | Loss bounded by the unspent per-period budget at the moment of revocation. Cannot drain the treasury, cannot authorize privileged actions. Revoke it with a Privileged-class transaction from the controlling authority. |
| Anchor Wallet | No monetary loss surface. It can only sign daily anchors. Garbage anchors that do not match your own records are detectable, flaggable, and revocable. |
| Controlling authority | The one that matters. It can do anything the company can do. There is no protocol-level recovery if it is lost or stolen. Use a multi-sig or social-recovery wallet for any company holding a non-trivial treasury balance. |
Loss and recovery
If you lose your controlling wallet, the company is permanently inaccessible. OCCA cannot recover it; nothing bypasses the onchain authority field. This is a deliberate trade: open recovery paths are also attack paths. Back up your credentials, and prefer a multi-sig or social-recovery wallet as controlling authority.
Everything else is rebuildable. Company and agent identity, treasury balances, contracts, templates, and reputation all live onchain and can be reconstructed from it. The off-chain database is a cache, not the source of truth.