Hardware-first security boundary.

Core principles

• Isolation: sensitive wallet approval is positioned around the hardware device rather than the phone environment.
• Verification: transaction details should be checked before approval.
• Clear role separation: Digital Shield Crypto Wallet is the interface layer, while the hardware wallet remains the main custody boundary.
• User responsibility: recovery phrases, private keys and passwords must never be shared with support.

Confirm on the device

The security model is easiest to understand as a two-part workflow: the app helps the user navigate, and the hardware wallet provides a separate confirmation point for critical actions.

• Review destination data carefully.
• Confirm only when device details match expectations.
• Keep recovery material offline and private.