Turnkey vs Privy

How the three compare

Why teams choose Turnkey

• Private keys only ever decrypt inside AWS Nitro Enclaves. Raw keys are never exposed to Turnkey, your software or your team, and no single engineer can reach an enclave.
• Every policy is enforced inside the enclave at the moment of signing, so compromising your application layer still does not produce a signature.
• Flexibility is yours, not ours: you define the signing flows, access models and policies, with organization-level permissions, delegated sessions, key reuse across products, and any onramp, bridge or staking provider you choose. Native Earn and Swaps are there when you want them and ignorable when you do not.
• Pricing is usage-based from $0.0015 per signature with no overages, so you pay for signing work rather than for user counts or transaction size.
• And you do not have to take any of it on trust. Turnkey publishes proofs anyone can check, over a build that can be reproduced from source.

Where Privy falls short

• Privy enforces only part of its policy inside the enclave. The rest runs as an off-enclave simulation at the API layer, so a compromise of that layer reaches controls the enclave never sees.
• A Privy signature needs more than the enclave to hold. An authentication service has to hand over the auth share, and further shares sit on the user's device and in password or cloud-backup recovery. Every one of those is another way in.
• Privy bills by monthly active user, so you pay for accounts whether or not they ever sign anything. Turnkey bills per signature, so you pay for work your product actually did.
• Privy runs Nitro attestation inside its own deployment process and lists customer access to attestation documents as coming soon. Reproducible builds are not described in its documentation.

Where Fireblocks falls short

• Fireblocks prices on outbound transaction volume, so the larger the transaction, the more the same signature costs you. Past your plan allowance, overage runs 0.20% per transaction. Essentials is $999 a month for at most six months, and custom plans start at $36,000 a year.
• Staking, automation, raw signing, cold wallet and tokenization are all paid add-ons, so the plan price is not the final price.
• Fireblocks enforces policy at its platform API and in a co-signer you host, not inside the enclave at the moment of signing. The rules do not live where the signature happens.
• Running Fireblocks reliably is your job. High availability means deploying customer-hosted co-signers in active-active mode and running your own monitoring and alerting.
• Fireblocks co-signer enclaves attest to a Fireblocks-operated server, so the party vouching for the code is Fireblocks.

What that adds up to

Turnkey is the best choice for teams that need security and flexibility together. Keys never leave the enclave and policy is enforced where the signature happens, you define your own signing flows and pick your own providers, and you pay per signature rather than per user or per dollar moved.

FAQs

How do Turnkey, Privy and Fireblocks differ in where signing policy is enforced?

Turnkey enforces policy inside the enclave at signing time, so a compromised application layer cannot bypass it. Privy splits enforcement between enclave execution and an off-enclave API layer. Fireblocks enforces policy rules and quorum approvals at its platform API layer, with an optional customer-hosted callback handler.
Explore the detail

Which of the three lets me independently verify the code running in the enclave?

Turnkey publishes Boot and App Proofs that chain to the AWS Nitro Secure Module, over a deterministically reproducible OS, application and build system, so a third party can rebuild and confirm the match. Privy uses Nitro attestation inside its own deployment process and lists customer access to attestation documents as coming soon. Fireblocks attests its co-signer enclaves against a Fireblocks-operated attestation server.
Explore the detail

How does pricing compare across Turnkey, Privy and Fireblocks?

Turnkey is usage-based from $0.0015 per signature with no overages. Privy prices on monthly active users in tiers, plus usage and integration fees. Fireblocks publishes plans at fireblocks.com/pricing: Essentials at $999 per month for up to six months and custom plans from $36,000 per year, priced on outbound transaction volume with a 0.20% overage rate.
Explore the detail

What do I give up by choosing Privy or Fireblocks over Turnkey?

With Privy, policy enforcement is split between the enclave and an off-enclave API layer, so some controls sit outside the place the signature actually happens, and your signing flows stay bounded by the integration patterns Privy exposes. With Fireblocks, policy is enforced at the platform API rather than at signing, high availability means running your own co-signers, and capabilities such as staking and raw signing are paid add-ons on top of volume-based pricing with a 0.20% overage rate. Neither publishes proofs you can check against a build you can reproduce yourself.
Explore the detail