Security is the defining factor in how wallet infrastructure behaves under real-world conditions. It determines where keys live, how actions are authorized, and what guarantees exist when something goes wrong. This section looks at the security models behind Turnkey and Fireblocks, and how those models affect control, trust, and long-term risk.
Choosing between Turnkey and Fireblocks | security
When Turnkey is a better fit
Turnkey is built for teams that want security enforced at the infrastructure layer. It offers:
- Key generation and signing confined to hardware-backed enclaves
- Verifiable execution that proves code and policy integrity
- Policy-driven authorization evaluated at the moment of signing
- Granular permissioning without exposing private material
- Full ownership of key lifecycle decisions
Turnkey assumes that security should be explicit and inspectable. Instead of inheriting preset assumptions, teams define their own trust model and enforce it consistently across every signing operation, with cryptographic evidence to back it up.
When Fireblocks might work
Fireblocks is designed for teams that prefer managed security with minimal surface area. It provides:
- Wallets secured through integrated identity and recovery flows
- Platform-defined safeguards that reduce configuration overhead
- A simplistic model that abstracts away most key management concerns
Fireblocks prioritizes safety through opinionated defaults. This reduces complexity for developers, but also limits how deeply teams can customize or verify the underlying security mechanics as requirements evolve.</p>
Turnkey vs Privy: Quick Compare
| Security Dimension | Turnkey | Fireblocks |
|---|---|---|
| Secure Enclave Usage | Keys are generated, stored, and used entirely inside AWS Nitro Enclaves for keygen, storage, and signing | Customer-hosted API Co-signer runs inside Intel SGX, AWS Nitro, or Google Cloud Confidential Spaces enclaves, protecting MPC key shares. |
| Key Custody Model | Private keys never leave the enclave and are never reconstructed externally | Non-Custodial Wallets use MPC-based key management with MPC_ECDSA_SECP256K1 and MPC_EDDSA_ED25519 algorithms. |
| End-to-End Reproducibility | Full reproducible builds with full-source bootstrap guarantees | (Not covered in public documentation) |
| Remote Attestation | Remote attestation proves the exact code and configuration running in the enclave | SGX Co-signer attests against a Fireblocks-operated Remote Attestation server to retrieve its database encryption key. |
| Policy Enforcement Location | Policies are enforced inside the enclave at signing time | Screening policy configuration is handled through the platform API; a customer-hosted callback handler sits in the signing path. |
| Policy Scope | Full organizational policy engine covering signing, delegation, hierarchy, permissions, and multi-chain behavior | Screening policy configuration is retrieved and updated through the platform API. |
| Trust Anchor | Security is based on cryptographic proof of enclave execution and reproducible code | (Not covered in public documentation) |
| Attack Surface | Single, hardware-isolated trust boundary with minimal external dependencies | MPC key shares, customer-hosted Co-signer, Callback Handler, and external monitoring stack across trust boundaries. |
| Auditability | Verifiable execution and policy-aligned audit logs | Workspace-level audit logs queryable via API for external SIEM and compliance tooling. |
| Security Philosophy | Infrastructure-first, verifiable, policy-driven security model | Policy and approval workflows are configured through the platform API, with signing performed by a customer-hosted co-signer. |
How does Turnkey and Fireblocks work for different builder’s needs?
Turnkey and Fireblocks both offer developer tools for building with wallets, but they serve different needs. Depending on what you're building, one may offer the speed or control you're looking for. Here's how they feel from the perspective of different builders.
Fintech builders need secure, compliant infrastructure that supports modern auth methods, policy-based controls, and fast developer integration. Turnkey and Fireblocks meet different needs across payments, embedded wallets, and crypto-financial apps.
Fintech Developers
Accelerate development with programmable wallets, passkeys, and bank-grade security APIs.
Highlights: SSO/MFA • Quotas • API-first
Explore Hub: Docs • Case Study • API Ref
Fintech Founders
Launch faster with compliant, secure infrastructure tailored for modern financial apps.
Highlights: SOC 2 • Region-aware infra • Recovery flows
Explore Hub: Docs • Case Study • API Ref
Payments Developer
Integrate programmable wallets into your payments stack with role-based controls and global reach.
Highlights: Role-based access • Quotas • Multi-region
Explore Hub: Docs • Case Study • API Ref
Payments Product Managers
Control who can initiate, approve, and recover funds in payment flows — with full audit support.
Highlights: Approvals • Recovery flows • Logs
Explore Hub: Docs • Case Study • API Ref
Crypto Consumer App Founder
Deliver secure onboarding and wallet flows with passkeys, MFA, and full policy control.
Highlights: Passkeys • Policy engine • Audit logs
Explore Hub: Docs • Case Study • API Ref
DeFi teams build at the edge of innovation, where programmable signing, smart contract hooks, and multichain support are critical. Turnkey and Fireblocks offer different approaches to execution, agent compatibility, and onboarding flexibility.
DeFi Developers
Ship faster with secure, programmable wallets that integrate seamlessly with DeFi protocols.
Highlights: Smart contract hooks • Chain support • SDKs
Explore Hub: Docs • Case Study • API Ref
DeFi Founders
Launch with confidence using scalable infrastructure, battle-tested security, and built-in compliance.
Highlights: Audit logs • Policy engine • Multichain
Explore Hub: Docs • Case Study • API Ref
Trading Developer
Build fast, secure trading systems with programmable keys, latency insights, and flexible APIs.
Highlights: Low-latency signing • SDKs • Policy guardrails
Explore Hub: Docs • Case Study • API Ref
Trading Founder
Protect assets, scale operations, and automate high-frequency trading flows — securely.
Highlights: Attestations • Policy enforcement • Observability
Explore Hub: Docs • Case Study • API Ref
Crypto Consumer App Developer
Create secure, easy-to-use wallets that abstract crypto complexity and maximize user retention.
Highlights: Key recovery • Chain abstraction • Policy engine
Explore Hub: Docs • Case Study • API Ref
Web3 Consumer App Founder
Launch faster with embedded wallets, fiat support, and battle-tested infra built for scale.
Highlights: Onramps • Delegated signing • SLA support
Explore Hub: Docs • Case Study • API Ref
Engineers want infrastructure they can program against, not just plug-and-play widgets. Whether you're building for Web3, agents, or wallets-as-a-service, Turnkey and Fireblocks offer contrasting models for security, extensibility, and control.
Computer Engineers
Low-level control and composability with secure enclaves, policy enforcement, and open SDKs.
Highlights: Secure enclaves • Signing policies • CLI tools
Explore Hub: Docs • Case Study • API Ref
Computer Engineering Leadership
Security, control, and observability that satisfy both infosec and shipping goals.
Highlights: Policy engine • Admin controls • SLA-backed infra
Explore Hub: Docs • Case Study • API Ref
Web3 Platform Developer
Provide wallets, keys, and permissions to your users with full API control and UX flexibility.
Highlights: Embedded wallets • Delegation • Recovery
Explore Hub: Docs • Case Study • API Ref
Web3 Consumer App Developer
Integrate passkey wallets, fiat onramps, and chain abstraction to onboard users with ease.
Highlights: Passkeys • Onramps • Multi-chain
Explore Hub: Docs • Case Study • API Ref
Crypto Consumer App Developer
Create secure, easy-to-use wallets that abstract crypto complexity and maximize user retention.
Highlights: Key recovery • Chain abstraction • Policy engine
Explore Hub: Docs • Case Study • API Ref
AI Agent Developer
Build agents that sign, swap, and transact safely using programmable policies and real-time context.
Highlights: EIP-712 support • Session tokens • Risk controls
Explore Hub: Docs • Case Study • API Ref
Agentic Developer
Infrastructure designed for autonomous actors — with approvals, limits, and auditability baked in.
Highlights: Autonomous ops • Approval rules • Audit trails
Explore Hub: Docs • Case Study • API Ref
DeFi teams build at the edge of innovation, where programmable signing, smart contract hooks, and multichain support are critical. Turnkey and Fireblocks offer different approaches to execution, agent compatibility, and onboarding flexibility.
Product Managers
Build with confidence: audit trails, approvals, and user flows you can configure without engineering.
Highlights: No-code policies • Audit logs • Roles
Explore Hub: Docs • Case Study • API Ref
Payments Product Managers
Control who can initiate, approve, and recover funds in payment flows — with full audit support.
Highlights: Approvals • Recovery flows • Logs
Explore Hub: Docs • Case Study • API Ref
Web3 Consumer App Founder
Launch faster with embedded wallets, fiat support, and battle-tested infra built for scale.
Highlights: Onramps • Delegated signing • SLA support
Explore Hub: Docs • Case Study • API Ref
Crypto Consumer App Founder
Deliver secure onboarding and wallet flows with passkeys, MFA, and full policy control.
Highlights: Passkeys • Policy engine • Audit logs
Explore Hub: Docs • Case Study • API Ref
FAQs
How do Turnkey and Fireblocks each use secure enclaves to protect private keys?
Turnkey generates, stores, and uses keys entirely inside AWS Nitro Enclaves, so private keys never leave the enclave and are never reconstructed externally. Fireblocks runs a customer-hosted API Co-signer inside Intel SGX, AWS Nitro, or Google Cloud Confidential Spaces enclaves to protect MPC key shares, with key shares split across parties using MPC-based key management.
Explore Compliance
Where are security policies enforced in Turnkey compared to Fireblocks?
Turnkey enforces policies inside the enclave at signing time, covering signing, delegation, hierarchy, permissions, and multi-chain behavior through a full organizational policy engine. Fireblocks manages and enforces policies at the platform API layer, including AML and Travel Rule screening policy configuration for compliance workflows.
Explore Flexibility
How do remote attestation and auditability differ between Turnkey and Fireblocks?
Turnkey uses remote attestation to prove the exact code and configuration running in its enclave and provides verifiable execution with policy-aligned audit logs. Fireblocks uses its SGX Co-signer to attest against a Fireblocks-operated Remote Attestation server to retrieve its database encryption key and offers workspace-level audit logs queryable via API for external SIEM and compliance tooling.
Explore User Management
How do the attack surfaces and overall security philosophies of Turnkey and Fireblocks compare?
Turnkey operates within a single, hardware-isolated trust boundary with minimal external dependencies and follows an infrastructure-first, verifiable, policy-driven security model. Fireblocks distributes its security across MPC key shares, a customer-hosted Co-signer, a Callback Handler, and an external monitoring stack spanning multiple trust boundaries, with policy and approval enforcement handled at the platform API layer.
Explore Product Philosophy
Choosing the right stack
Whether you're building a DeFi protocol, a fintech app, or an agent-powered platform, the right wallet infrastructure depends on your goals. Turnkey offers granular control, security, and scale for teams that need infrastructure-grade reliability. Choose what fits today and what won’t limit you tomorrow.