Recovery & guardians.

01Guardians

Guardians are trusted contacts with two roles: they approve changes to the account’s security settings, and they help restore access if a device or the written recovery phrase is lost. Adding a guardian requires mutual consent: an invitation is sent, and the guardian must accept it before becoming active.

The first guardian can be added directly. Each guardian after that requires a majority vote among the guardians already in place, the same threshold that applies to removing one. Removing the last guardian, when no one is left to vote, instead requires confirming possession of the recovery phrase.

A guardian’s role is to approve, never to act. Every change a guardian approves is a proposal created by the account holder, from a fixed set of account-level actions. A guardian cannot create a proposal, cannot move or spend funds, and cannot change anything unilaterally, whether an account has one guardian or many. How a proposal is created, approved, and applied is described in proposals.

02The recovery phrase

The recovery phrase is generated on the device and never leaves it in readable form. At setup, it is encrypted locally before being stored in the device’s secure hardware storage. The plain phrase is never transmitted anywhere, including to Summo.

A backup of the phrase exists only in encrypted form, and neither Summo nor any guardian can read it on their own. Revealing the phrase in the app is a gated action. With no guardian configured, it requires a fresh biometric check on the device. With guardians configured, a sealed copy of the encrypted phrase exists for each guardian, which only that guardian can open. Opening it yields the encrypted form alone, so no guardian ever sees the phrase itself; reconstructing it takes the guardians’ approval, a key held by Summo, and the account holder’s own device. Revealing the phrase then requires guardian approval. Every release request is reported to the account holder by email.

The backup key depends on this protection. The device key alone cannot move funds: it is one key of three, and Summo’s co-signature is subject to the security policy and the freeze. The backup key would complete the threshold without Summo, and it can only be derived from the recovery phrase. With guardians configured, the phrase cannot be decrypted on the device alone, even an unlocked one, so the backup key remains out of reach until guardians approve.

03Recovering a lost phone

Recovery begins on a new device, which requests access. Every guardian who has accepted an invitation is eligible to vote immediately. A guardian cannot be planted from a stolen session, since creating an invitation requires a signature from the account holder’s own device key. Before voting, each guardian confirms the request with the account holder directly. On a live call, the account holder reads out a short verification code shown on the new device, and the guardian enters it in the app. The code identifies the new device and reveals no secret, so a guardian approves recovery only for the person they have spoken with. Each guardian then re-seals their copy of the encrypted phrase toward the new device and casts a signed vote.

Once enough guardians have voted, a 30-minute window opens in which the new device completes recovery, combining the guardians’ resealed copies with a key held by Summo to reconstruct the recovery phrase locally. The device key and backup key are then rebuilt as described in the account model, and normal access resumes. The phrase is re-secured under fresh encryption, and shown once more for a new written backup.

The original device keeps a veto throughout: for as long as it remains reachable, its holder can block an in-progress or already-approved recovery for 72 hours with a single signed action.

The written recovery phrase restores the account at any time, independently of Summo. Guardians are the path back when the written copy is also lost.

04The quorum

The number of guardians required to approve a recovery is configurable, from one up to the full guardian count, and defaults to a strict majority of active guardians: one of one, two of two, two of three, and so on. An account with exactly two guardians requires both, and so has no redundancy if one is unreachable. A third guardian removes that gap, which is why the guardian screen recommends one.

The threshold determines how many guardians must vote to restore access, and has no bearing on the separate guarantee below: no guardian, or group of guardians, can move funds, regardless of how many are configured or how the threshold is set.

05Self-custody, kept

Recovery never grants Summo, or any guardian, the ability to move funds. Recovery restores the account holder’s own key material, the device key and backup key, and never a new party’s ability to act on the account. Access after recovery works the same way as before. For the threat model, see the security model.