One account, every chain, three keys.

A Summo account is a smart-contract account governed by three keys under a two-of-three signing threshold. The account holder holds two of the keys, a device key and a backup key; Summo holds the third, a co-signer that signs only after checking the transaction. The same structure is provisioned on every network Summo supports.

01At a glance

A Summo account is a set of smart-contract accounts, one on each blockchain in use, governed together as one account.

Each of those accounts requires two of three keys to move funds. The device key and backup key both derive from a single recovery phrase, so two of the three keys always remain within the account holder’s control. Summo, holding only the co-signer key, can never move funds on its own.

02Accounts across chains

Summo supports two families of chains, and provisions a different kind of smart account on each. Both are built the same way: a 2-of-3 account controlled by the same three keys.

EVM chains (Ethereum, Base, Arbitrum, Polygon, and more). The account is a Gnosis Safe, a smart-contract wallet built on the ERC-4337 account-abstraction standard, with three owners: the device key, the backup key, and Summo’s co-signer. The device key is generated on the device and is commonly called an EOA (externally owned account). The EOA signs on the Safe’s behalf but never holds or receives funds; the Safe is the only address that does.
Solana. The account is a Squads v4 vault, a single address that both holds and receives assets. The vault has the same three owners: the device key, the backup key, and Summo’s co-signer. As on EVM, the keys only sign; the vault alone holds funds.

The recovery phrase produces the device key and the backup key; Summo produces the co-signer. The device key and co-signer (solid lines) sign a routine transaction together, the co-signer only once its policy checks pass. The backup key (dashed) is not stored anywhere: it is re-derived from the phrase only if the device key is ever unavailable, and guardians, once set up, protect the path back to that phrase.

03The three keys

Summo accounts are 2-of-3 multisig: three keys exist, and any two must sign for a transaction to proceed.

The device key. Derived from the recovery phrase, generated and stored on the device. On EVM this is the EOA; on Solana, the vault’s device-held member key. The device key signs every transaction, alongside Summo’s co-signer.
The backup key. A second key derived from the recovery phrase, not stored separately: only its address is kept, and the key is re-derived from the phrase when needed. The backup key signs once, at account setup, and afterward serves as a reserve rather than a routine signer. See recovery and guardians for what happens if the phrase or the device is lost.
Summo’s co-signer. A key held on Summo’s servers, which provides the second signature a normal transaction needs. What it checks before signing, and when it refuses, is described in the co-signer.

Two consequences follow from that threshold:

Summo can never move funds unilaterally. Its co-signer is one key of three: never enough on its own.
Funds can always be moved without Summo. Both keys derive from the recovery phrase, so whoever holds the phrase can reconstruct them and meet the two-key threshold without Summo, even if Summo ceased to operate. This is what makes a Summo account self-custodial, and why the recovery phrase must be preserved.