Backup and disaster recovery responsibilities depend on your deployment model. With fully-managed DFNS Cloud (SaaS), DFNS operates the signers and handles all backup and disaster recovery for you. With hybrid or on-premise deployments, you operate one or more signers yourself and are responsible for backing up and recovering the components in your environment. This page covers what to protect and how to recover in each case.
Beyond restoring infrastructure, two customer-controlled options give MPC wallets an independent recovery path, so you can reconstruct your keys and keep operating even if DFNS is unavailable. Both back up the same thing — each signer’s key share, encrypted to a key only you hold — and differ only in how the backup is triggered:
- Manual key backup — export a wallet’s key shares on demand, and reconstitute the full key locally only when you need it. Available to most customers.
- Layer 4 — the same backup, made automatically and continuously to storage you own. Dedicated MPC clusters only.
MPC signer backups
When hosting MPC signers, the following assets must be backed up:
Recovery scenarios
Losing your encryption keys without Layer 4 means losing access to all wallets and the assets they hold.
HSM backups
When using an HSM integration, the following assets must be backed up:
Recovery scenarios
Losing the HSM master key means losing access to all wallets and the assets they hold. Back it up immediately after generation.
Layer 4 disaster recovery
Layer 4 gives dedicated MPC clusters a fully independent recovery path. It automatically encrypts each key share with your Ed25519 public key during wallet creation and stores the encrypted backup in an S3 bucket you own.
Layer 4 requires a dedicated MPC cluster; it is not available on the standard shared DFNS Cloud infrastructure that most customers use. Once you have a dedicated cluster, Layer 4 works with any MPC deployment option: fully managed by DFNS, hybrid, or on-premise. Without a dedicated cluster, use manual key backup instead — as most customers do.
How it works
When Layer 4 is enabled, each signer encrypts its key share with your public key every time a key is generated, imported, or copied. The encrypted share is then written to your S3 bucket. DFNS never has access to your private key, so only you can decrypt and recover the backups.
Each signer writes to its own prefix in the bucket (e.g. signer-0/, signer-1/). The backup happens automatically for every wallet created after Layer 4 is enabled.
What Layer 4 protects against
- Encryption key loss: Without Layer 4, losing signer encryption keys is unrecoverable. With Layer 4, you can decrypt key shares from your own storage.
- Database loss beyond last backup: Standard database backups have a recovery point. Layer 4 backups are written at key generation time, so no gap exists.
- DFNS unavailability: Recovery is entirely independent of DFNS. You only need your private key and the backup files.
Security properties
- Customer-controlled encryption. Shares are encrypted with your Ed25519 public key. DFNS cannot decrypt the backups.
- Write-only signer access. Signers have
s3:PutObject permission only. They cannot read, modify, or delete existing backups.
- Independent recovery. You can recover your keys at any time using only your private key and the backup files.
- Complementary to database backups. Layer 4 does not replace standard database backups. It provides an additional recovery path for scenarios where those backups are unavailable.
Setup
Layer 4 setup is covered in the MPC signer deployment. It involves generating an Ed25519 key pair, creating an S3 bucket, and configuring the signers. To enable Layer 4 or for questions about the setup process, contact our .
Manual key backup (key export)
You can export a copy of any MPC wallet’s key on demand, giving you a backup you hold outside DFNS. It is the fallback available to most customers, whatever their deployment model. As with Layer 4, DFNS never handles a plaintext key (how export works).
A reconstituted key is a full, standalone private key — a single point of failure. Anyone who obtains it controls the wallet and its assets, and DFNS cannot guarantee the security of transactions signed with it. Once it leaves DFNS, its security is entirely your responsibility: storage, encryption at rest and in transit, access controls, usage restrictions, and protection against theft or misuse.
Layer 4 vs. manual key backup
Both produce the same artifact: each signer’s key share, encrypted to a key you control, and both recover through the same client-side reconstitution. DFNS never holds a plaintext key in either case. They differ only in how and when the backup is made:
