ControlPrivate Custody,
from concept to market

Short release cycles. Dependencies last.

A 23-week roadmap in three lanes: Product, Engineering, Security. A push to production every two to four weeks. Epics that depended on Fireblocks went last.

Actions start on the console. The phone confirms them.

Portfolio, accounts, activity, beneficiaries: everything is viewed in the web console, where every important action starts. The client confirms it on the iOS app.

Name the account first, then choose what it holds.

Naming comes first, asset selection second. The same token can live on several networks, so batch selection saves repetition while each asset–network pair stays visible. Search and a review step keep the complexity manageable.

Trade-off. Adding several assets at once is faster, but it raises the risk of sending to the wrong network. Each pick stays visible as an asset–network chip. Production also asks the client to confirm the network before adding it.

Signature moments, designed to be understood.

Security steps are where a client most needs to pay attention. We treated them as signature moments, each with oversized type and its own animation. Graphics and motion explain the step along with the words.

Setting the Security Phrase and generating the keys are two of them.

Complete ownership with institutional infrastructure.

Individuals and families who value direct ownership are often anxious about hardware wallets. Some hesitate to adopt them; others already use them and carry the operational burden. A custodian removes that burden, but takes the ownership with it.

I defined Private Custody as a third model: the private banking approach to digital self-custody. Beyond the split key, the client can always download the full key on their own, with a Relationship Manager as part of the product.

One product. One visual language.

The same system runs across the product, the website and social channels. Its base is a restrained green palette with editorial typography. Detail unfolds progressively, from accounts to assets to collectibles.

Edge cases written down as rules.

• Empty statesNo pending actions, no beneficiaries, no collectibles: each says what will appear and when.
• NavigationThe bottom bar always reflects the current section, with exactly one expanded tab.
• Long inputA long Security Phrase wraps across lines instead of truncating, with a live “matches” check.
• LimitsAccount names are capped and counted (6/20), with examples in place.

From zero to a new client in 30 seconds.

Onboarding has to sync two surfaces, the web console and the iOS app, before keys are generated. That handoff made it one of the most complex flows in the product. It took many iterations to bring it down to 30 seconds.

Built for the moment it goes wrong.

Duress Protocol is a silent panic button disguised as a normal PIN. If a client is forced to sign, the emergency PIN keeps the app looking normal while it alerts a trusted contact and shares the device's current location.

Live, with real funds.

Clients use Control on iOS and web today. Live features include multiple accounts per client, beneficiaries, Duress Protocol, selectable signing methods and Key Integrity Check. Control Individual is publicly available; Control Shared has a waitlist.