Introducing Enterprise Disaster Recovery: Infrastructure your assets can depend on

Enterprise Disaster Recovery with Turnkey gives teams a secure, auditable path to import wallets and restore full signing capability, without exposing key material at any point in the process.

Keys are encrypted on your existing infrastructure, transmitted as encrypted bundles, and decrypted only inside Turnkey's secure enclaves. Pre-configured policies activate the moment wallets are imported, so recovered assets are never unprotected. A single import path covers Bitcoin, Ethereum, Solana, and all other chains built on the same underlying signing algorithms.

This article covers how the solution works, what it protects against, and how to get started.

What makes wallet recovery a security risk

Recovery is where custody models are most vulnerable. The operation that is supposed to restore access to assets is often the moment those assets are most exposed.

In most setups, recovery and security are handled sequentially. Wallet access is restored first, and access controls, quorum policies, and audit logging are configured after the fact. That gap, even if it lasts minutes, creates a window where recovered assets sit without protection.

Chain-specific recovery adds friction. Organizations holding assets across multiple networks often need separate recovery operations for each chain, each with its own tooling and procedures. This slows recovery time and increases the surface area for mistakes.

Audits are another problem. Standard log files can be modified by anyone with infrastructure access. When a recovery event is contested or reviewed for regulatory compliance, logs alone are not sufficient to prove what happened, when, and who authorized it.

Together, these constraints make wallet recovery less about restoring access and more about how risk, speed, and accountability are structured across the entire operation. For enterprises, this makes disaster recovery a core component of a broader business continuity strategy, instead of just an afterthought.

How to set up Enterprise Disaster Recovery with Turnkey

Enterprise Disaster Recovery separates key material, access control, and audit into distinct layers, with enforcement handled at the infrastructure level.

Here is a typical flow:

1. Set up your organization and recovery policies

Create a Turnkey organization and establish the security foundation. Create dedicated recovery users with scoped permissions, distribute authenticators across geographic locations, and define policies that restrict what recovered wallets can do, such as limiting fund movement to allowed addresses. 

2. Integrate the Turnkey SDK

Add Turnkey to your application using the NodeJS server SDK. This SDK  handles the entire import flow, including encryption and secure transport.

3. Import wallets into Turnkey's secure enclave

Behind the scenes, the SDK encrypts the private key to Turnkey using HPKE (Hybrid Public Key Encryption), a standard that ensures data can only be decrypted by the intended recipient.

The encrypted bundle is transmitted to the enclave, where it is decrypted and stored. 

What Enterprise Disaster Recovery delivers

Enterprise disaster recovery must do more than restore wallet access. It must define how risk is distributed, how access is controlled, how recovery is triggered, and how every step is verified.

Turnkey provides the infrastructure to support these requirements.

No single point of failure

Within your organization, quorum approval requirements distribute authority across multiple approvers, each holding their own independent credential. No single person can unilaterally trigger a recovery or move funds. If one key holder becomes unavailable, operations continue without interruption.

Access enforced by policy, not application code

All key access during recovery is enforced by Turnkey's policy engine at the infrastructure layer. Teams define exactly when and how recovered wallets can be used: who can sign, which addresses funds can move to, how many approvals are required, and under what conditions exports are permitted.

These controls activate the instant wallets are imported. There is no configuration window after recovery where assets sit unprotected. Traditional custody platforms restore access first and leave security as a follow-up step. With Turnkey, policies are inherited on import.

Recovery tied to user authentication

Key access during recovery is tied directly to user authentication. Support for email, passkeys and more allows teams to build recovery flows that are both secure and operationally familiar.

Authenticators can be distributed across geographic locations, so recovery is not dependent on a single device or facility. Every recovery action requires the authenticated user to be present, preventing unauthorized access even if other parts of the infrastructure are compromised.

Verifiable enclave isolation

All recovery operations run inside AWS Nitro Enclaves, dedicated isolated hardware environments where key material is never exposed outside the enclave boundary. Decryption happens exclusively inside the enclave. Turnkey's infrastructure only ever sees encrypted data.

Remote attestation allows teams to independently verify that the enclave is running unmodified, approved code. This is not a trust-based assurance. It is a cryptographic proof that anyone can check.

Enterprise Disaster Recovery with Turnkey: Recovery without compromise

Enterprise Disaster Recovery with Turnkey gives teams the ability to restore wallet access and signing capability without creating an exposure window or forcing separate recovery processes per chain.

Teams get hardware-backed key isolation, configurable quorum policies, multichain support, and a cryptographic audit trail in a single infrastructure layer. They define their organization's recovery policies, authenticators, and authorization rules upfront. Turnkey handles the rest: secure import, policy enforcement, enclave isolation, and audit logging.

If you are ready to build disaster recovery into your infrastructure, explore the documentation to get started.

Start building with Turnkey today.

‍