Summo’s co-signer.

The key Summo holds, what it checks before it signs, and what it can never do.

01Role

Every Summo account requires two of three signatures to move funds. The account holder’s device key provides the first. Summo’s co-signer, a key held on Summo’s servers, provides the second, and only after checking the transaction. See the account model for the full key structure.

As one key of three, the co-signer can approve a transaction but can never move funds by itself. The account holder’s own two keys can always move funds without it, so Summo can neither spend from an account nor prevent its owner from moving funds with their own keys.

02What it checks

The co-signer signs only after checking the transaction against the account’s security policy. One part of the policy is mandatory and always on. A second part is optional, and requires at least one guardian before it can be used.

Sanctions and scam screening. Every destination address is checked against a blocklist of sanctioned and known-scam addresses before Summo co-signs. This check is always on, for every account.
Spending limits. An optional per-transaction or daily cap. Using one requires at least one guardian. Tightening a limit, or setting one for the first time, takes effect immediately; loosening or removing one requires guardian approval, either permanently or for a temporary window that reverts on its own.
Trusted addresses. An address exempted from the spending limit, also requiring at least one guardian. Adding one requires guardian approval; removing one does not.

Loosening a limit or adding a trusted address is a proposal that guardians approve; see proposals.

03When it does not sign

The co-signer refuses in four situations. A refused transaction never reaches the network, and nothing moves.

A blocked destination. The destination matches the blocklist; the app explains why.
A policy breach. The transaction exceeds a spending limit and the destination is not a trusted address.
A frozen account. If a device is in the wrong hands, the account can be frozen, and the co-signer withholds its signature from every money path until control is regained. See the freeze in the security model.
Anything it cannot verify. Checks on the money path fail closed. A transaction that cannot be decoded and verified is not signed.