# Security (/resources/security)

Your wallet signs the user transactions you approve. Akashi's backend does not hold private keys or sign on your behalf. That is one security boundary. The contracts, investments and authorities involved have their own risks.

## Non-custodial by design [#non-custodial-by-design]

A direct Akashi deposit enters the selected external protocol. A vault deposit enters the vault, and your wallet holds Senior or Junior shares. Those are different ownership and exit paths.

A website outage does not erase the accounts. It can make submitting an action harder, and another interface cannot remove liquidity, coverage, pause or protocol conditions.

## Akashi vaults [#akashi-vaults]

The core program checks supported instructions, valuations and configured limits. The executor, admin and guardian have different powers, including some that can restrict operations. An upgrade authority can be separate from those roles.

Read [who controls what](/invest/who-controls-what) for the overview and [governance and permissions](/invest/advanced/governance-and-permissions) for the detailed trust model.

## Controls on every change [#controls-on-every-change]

Tests and audits apply to particular code, versions and scenarios. A review of an external venue does not automatically cover Akashi's core, adapter or combined strategy. When examining a report, check its scope, code version, findings and unresolved limitations.

[Reviewing a vault](/invest/advanced/due-diligence) explains which evidence to inspect.

## Protocol risk and interface risk are separate [#protocol-risk-and-interface-risk-are-separate]

A risk grade describes modelled investment factors. It does not certify a website or wallet signature. An underlying asset loss and a compromised interface can harm you through different paths.

Check the domain, network and requested action before signing. Support never needs your recovery phrase or private key. See [wallets and transactions](/akashi/wallets-and-transactions) for the signature flow.

## Reporting a security issue [#reporting-a-security-issue]

Follow the instructions on [Akashi Security](https://akashi.finance/security). The published contact is **security@akashi.finance**. Include reproduction details and public identifiers, and allow time for investigation before public disclosure.

For ordinary product issues, use the [feedback form](https://akashi.finance/feedback).