Hack us, bribe us, bankrupt us: it ends at home.

If Fortcore is hacked or coerced

Fortcore holds no key that can sign a transfer, so a hacked or coerced Fortcore can't send your money anywhere but home. The most it could do:

• Lock your vault, within the guardian's budget, for 42 days at most.
• Cancel withdrawals, within its budgets.
• Start a return that pays only your own homes.

It can't change your homes, keys or limits, upgrade your vault, or point a return anywhere else. Payment, support and billing systems can never produce one of your signatures, and no hidden key can stand in for a role. Roles and budgets.

If Fortcore goes offline

• Your vault's rules live on-chain and keep working: waits, cancellations and returns don't need our servers.
• The app reads the chain itself, shows the last block it saw, and tells you when your vault isn't being monitored.
• An independent watcher, run by another company, watches every vault for added phones, returns and a wind-down.
• Anyone can submit a signed instruction and pay its network fee. Fortcore's relayer is a convenience, not a gatekeeper.

If Fortcore shuts down

1. 1We announce it publicly at least 30 days ahead. It can be withdrawn only during those 30 days.
2. 2A wind-down needs Fortcore and an independent trustee together, covers every vault at once, and can't be aimed at one customer.
3. 3When it takes effect, an independent operator starts every vault's 90-day return to its verified home.
4. 4You can replace yours with a faster return of your own, from the app or the exit kit.

Paid for in advance

A funded continuity reserve covers 90 days of operations, the independent operator's returns for every vault, ten years of the restore domain with its trustee, and five years of hosting for the exit kit.

Where your passkey works

Your cloud passkey works only on a restore domain held by an independent trustee, paid ten years ahead and locked at the registry. If it were lost, your phone keys don't use it and the inactivity return still runs. If someone captured it, the most they could ask your passkey to do is add a phone, which waits 48 hours while you're alerted, or send everything home.

A last way home

If your vault's ordinary rules ever stop working, a phone or Fortcore's guardian can request the hatch. If no phone cancels it within 90 days, everything goes home by a minimal path that skips withdrawals, screening, subscriptions and price feeds. It still needs your vault's contract, Safe, the tokens and Base to work, so it can't rescue a vault from a defect in its own contract.